ARC: add independent-source testcase. Fix signatures by not line-terminating

last header line being hashed.

7 files changed, 298 insertions, 155 deletions

diff --git a/src/src/arc.c b/src/src/arc.c
index e1fef6fb8..a0e2184bd 100644
--- a/src/src/arc.c
+++ b/src/src/arc.c
@@ -564,11 +564,11 @@ while ((hn = string_nextinlist(&headernames, &sep, NULL, 0)))
       break;
       }
 
-/* Finally add in the signature header (with the b= tag stripped) */
+/* Finally add in the signature header (with the b= tag stripped); no CRLF */
 
 s = ams->rawsig_no_b_val.data, len = ams->rawsig_no_b_val.len;
 if (relaxed)
-  len = Ustrlen(s = pdkim_relax_header_n(s, len, TRUE));
+  len = Ustrlen(s = pdkim_relax_header_n(s, len, FALSE));
 DEBUG(D_acl) pdkim_quoteprint(s, len);
 exim_sha_update(&hhash_ctx, s, len);
 
@@ -865,6 +865,8 @@ if (!exim_sha_init(&hhash_ctx, pdkim_hashes[hashtype].exim_hashmethod))
            header canonicalization defined in Section 3.4.2 of
            [RFC6376].  Pass the canonicalized result to the hash
            function.
+
+Headers are CRLF-separated, but the last one is not crlf-terminated.
 */
 
 DEBUG(D_acl) debug_printf("ARC: AS header data for verification:\n");
@@ -895,7 +897,7 @@ for (as2 = ctx->arcset_chain;
   al = as2->hdr_as;
   if (as2->instance == as->instance)
     s = pdkim_relax_header_n(al->rawsig_no_b_val.data,
-					al->rawsig_no_b_val.len, TRUE);
+					al->rawsig_no_b_val.len, FALSE);
   else if (!(s = al->relaxed))
     al->relaxed = s = pdkim_relax_header_n(al->complete->text,
 					    al->complete->slen, TRUE);
@@ -952,7 +954,7 @@ if ((errstr = exim_dkim_verify(&vctx,
   {
   DEBUG(D_acl)
     debug_printf("ARC i=%d AS headers verify: %s\n", as->instance, errstr);
-  arc_state_reason = US"seal sigverify init error";
+  arc_state_reason = US"seal sigverify error";
   return US"fail";
   }
 
@@ -1328,10 +1330,8 @@ if (g->s[g->ptr - 1] == ':') g->ptr--;
 g = string_catn(g, US";\r\n\tb=;", 7);
 
 /* Include the pseudo-header in the accumulation */
-/*XXX should that be prepended rather than appended? */
-/*XXX also need to include at the verify stage */
 
-s = pdkim_relax_header_n(g->s + ams_off, g->ptr - ams_off, TRUE);
+s = pdkim_relax_header_n(g->s + ams_off, g->ptr - ams_off, FALSE);
 hdata = string_cat(hdata, s);
 
 /* Calculate the signature from the accumulation */
@@ -1440,7 +1440,7 @@ for (as = Ustrcmp(status, US"fail") == 0
   h = as->hdr_ams->complete;
   hdata = string_cat(hdata, pdkim_relax_header_n(h->text, h->slen, TRUE));
   h = as->hdr_as->complete;
-  hdata = string_cat(hdata, pdkim_relax_header_n(h->text, h->slen, TRUE));
+  hdata = string_cat(hdata, pdkim_relax_header_n(h->text, h->slen, !!as->next));
   }
 
 /* Calculate the signature from the accumulation */
diff --git a/src/src/pdkim/pdkim.c b/src/src/pdkim/pdkim.c
index 381bdbc5d..78d30979d 100644
--- a/src/src/pdkim/pdkim.c
+++ b/src/src/pdkim/pdkim.c
@@ -1734,11 +1734,19 @@ for (sig = ctx->sig; sig; sig = sig->next)
       sig->verify_ext_status = PDKIM_VERIFY_INVALID_SIGNATURE_ERROR;
 
       DEBUG(D_acl) debug_printf(
-	  " Error in DKIM-Signature header: tags missing or invalid\n"
-	  "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
+	  " Error in DKIM-Signature header: tags missing or invalid (%s)\n"
+	  "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n",
+	  !(sig->domain && *sig->domain) ? "d="
+	  : !(sig->selector && *sig->selector) ? "s="
+	  : !(sig->headernames && *sig->headernames) ? "h="
+	  : !sig->bodyhash.data ? "bh="
+	  : !sig->sighash.data ? "b="
+	  : sig->keytype < 0 || sig->hashtype < 0 ? "a="
+	  : "v="
+	  );
       goto NEXT_VERIFY;
       }
-
+ 
     /* Make sure sig uses supported DKIM version (only v1) */
     if (sig->version != 1)
       {
diff --git a/test/aux-fixed/4560.msg1.txt b/test/aux-fixed/4560.msg1.txt
new file mode 100644
index 000000000..d35aaae14
--- /dev/null
+++ b/test/aux-fixed/4560.msg1.txt
@@ -0,0 +1,8 @@
+Authentication-Results: test.ex; arc=none
+From: mrgus@text.ex
+To: bakawolf@yahoo.com
+Date: Thu, 19 Nov 2015 17:00:07 -0700
+Message-ID: <qwerty1234@disco-zombie.net>
+Subject: simple test
+
+This is a simple test.
diff --git a/test/aux-fixed/dkim/sign_arc.pl b/test/aux-fixed/dkim/sign_arc.pl
new file mode 100644
index 000000000..acf40ca9f
--- /dev/null
+++ b/test/aux-fixed/dkim/sign_arc.pl
@@ -0,0 +1,51 @@
+use Mail::DKIM::ARC::Signer;
+use Mail::DKIM::TextWrap;  #recommended
+use Getopt::Long;
+
+# default option values
+my $method = "simple/simple";
+my $selector = "sel";
+my $keyfile = "aux-fixed/dkim/dkim.private";
+my $algorithm = "rsa-sha256";
+
+GetOptions(
+	"method=s" => \$method,
+	"selector=s" => \$selector,
+	"keyfile=s" => \$keyfile,
+	"algorithm=s" => \$algorithm,
+);
+
+# create a signer object
+my $signer = Mail::DKIM::ARC::Signer->new(
+                  Algorithm => $algorithm,
+                  Chain => 'none',    # or pass|fail|ar
+                  Domain => 'test.ex',
+                  SrvId => 'test.ex',
+                  Selector => $selector,
+                  KeyFile => $keyfile,
+                  Headers => 'x-header:x-header2',
+             );
+
+
+  # NOTE: any email being ARC signed must have an Authentication-Results
+  # header so that the ARC seal can cover those results copied into
+  # an ARC-Authentication-Results header.
+
+# read an email and pass it into the signer, one line at a time
+while (<STDIN>)
+{
+      # remove local line terminators
+      chomp;
+      s/\015$//;
+
+      # use SMTP line terminators
+      $signer->PRINT("$_\015\012");
+}
+$signer->CLOSE;
+
+die 'Failed' . $signer->result_details() unless $signer->result() eq 'sealed';
+
+# Get all the signature headers to prepend to the message
+# ARC-Seal, ARC-Message-Signature and ARC-Authentication-Results
+# in that order.
+print $signer->as_string;
diff --git a/test/log/4560 b/test/log/4560
index 887655969..88f7ff2f7 100644
--- a/test/log/4560
+++ b/test/log/4560
@@ -1,127 +1,133 @@
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmaX-0005vi-00 arc_state: <none>
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss for za@test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 arc_state: <pass>
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss ARC id=qwerty1234@disco-zombie.net for a@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 10HmaY-0005vi-00 arc_state: <pass>
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for a@test.ex
-1999-03-02 09:44:33 10HmaX-0005vi-00 => a@test.ex <za@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => a <a@test.ex> R=d1 T=tfile
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
+1999-03-02 09:44:33 10HmaY-0005vi-00 arc_state: <none>
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss for za@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 10HmaY-0005vi-00 => a <a@test.ex> R=d1 T=tfile
+1999-03-02 09:44:33 10HmaZ-0005vi-00 arc_state: <pass>
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for a@test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 => a@test.ex <za@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
-1999-03-02 09:44:33 10HmaZ-0005vi-00 arc_state: <none>
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss for zza@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 10HmbA-0005vi-00 arc_state: <pass>
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for za@test.ex
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => za@test.ex <zza@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => a <a@test.ex> R=d1 T=tfile
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
+1999-03-02 09:44:33 10HmbA-0005vi-00 arc_state: <none>
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss for zza@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp
 1999-03-02 09:44:33 10HmbB-0005vi-00 arc_state: <pass>
-1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for a@test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 => a@test.ex <za@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbB-0005vi-00"
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for za@test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 => za@test.ex <zza@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbB-0005vi-00"
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 10HmbB-0005vi-00 => a <a@test.ex> R=d1 T=tfile
+1999-03-02 09:44:33 10HmbC-0005vi-00 arc_state: <pass>
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for a@test.ex
+1999-03-02 09:44:33 10HmbB-0005vi-00 => a@test.ex <za@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbC-0005vi-00"
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
-1999-03-02 09:44:33 10HmbC-0005vi-00 arc_state: <none>
-1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss for zmza@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 10HmbD-0005vi-00 arc_state: <pass>
-1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for mza@test.ex
-1999-03-02 09:44:33 10HmbC-0005vi-00 => mza@test.ex <zmza@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbD-0005vi-00"
+1999-03-02 09:44:33 10HmbC-0005vi-00 => a <a@test.ex> R=d1 T=tfile
 1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
+1999-03-02 09:44:33 10HmbD-0005vi-00 arc_state: <none>
+1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss for zmza@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp
 1999-03-02 09:44:33 10HmbE-0005vi-00 arc_state: <pass>
-1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for za@test.ex
-1999-03-02 09:44:33 10HmbD-0005vi-00 => za@test.ex <mza@test.ex> R=mlist T=tmlist H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbE-0005vi-00"
+1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for mza@test.ex
+1999-03-02 09:44:33 10HmbD-0005vi-00 => mza@test.ex <zmza@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbE-0005vi-00"
 1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 Start queue run: pid=pppp
 1999-03-02 09:44:33 10HmbF-0005vi-00 arc_state: <pass>
-1999-03-02 09:44:33 10HmbF-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for a@test.ex
-1999-03-02 09:44:33 10HmbE-0005vi-00 => a@test.ex <za@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbF-0005vi-00"
+1999-03-02 09:44:33 10HmbF-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for za@test.ex
+1999-03-02 09:44:33 10HmbE-0005vi-00 => za@test.ex <mza@test.ex> R=mlist T=tmlist H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbF-0005vi-00"
 1999-03-02 09:44:33 10HmbE-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 10HmbF-0005vi-00 => a <a@test.ex> R=d1 T=tfile
+1999-03-02 09:44:33 10HmbG-0005vi-00 arc_state: <pass>
+1999-03-02 09:44:33 10HmbG-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for a@test.ex
+1999-03-02 09:44:33 10HmbF-0005vi-00 => a@test.ex <za@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbG-0005vi-00"
 1999-03-02 09:44:33 10HmbF-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
-1999-03-02 09:44:33 10HmbG-0005vi-00 arc_state: <none>
-1999-03-02 09:44:33 10HmbG-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss for zzmza@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 10HmbH-0005vi-00 arc_state: <pass>
-1999-03-02 09:44:33 10HmbH-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for zmza@test.ex
-1999-03-02 09:44:33 10HmbG-0005vi-00 => zmza@test.ex <zzmza@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbH-0005vi-00"
+1999-03-02 09:44:33 10HmbG-0005vi-00 => a <a@test.ex> R=d1 T=tfile
 1999-03-02 09:44:33 10HmbG-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
+1999-03-02 09:44:33 10HmbH-0005vi-00 arc_state: <none>
+1999-03-02 09:44:33 10HmbH-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss for zzmza@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp
 1999-03-02 09:44:33 10HmbI-0005vi-00 arc_state: <pass>
-1999-03-02 09:44:33 10HmbI-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for mza@test.ex
-1999-03-02 09:44:33 10HmbH-0005vi-00 => mza@test.ex <zmza@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbI-0005vi-00"
+1999-03-02 09:44:33 10HmbI-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for zmza@test.ex
+1999-03-02 09:44:33 10HmbH-0005vi-00 => zmza@test.ex <zzmza@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbI-0005vi-00"
 1999-03-02 09:44:33 10HmbH-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 10HmbJ-0005vi-00 arc_state: <fail>
-1999-03-02 09:44:33 10HmbJ-0005vi-00 reason:    <AMS body hash miscompare>
-1999-03-02 09:44:33 10HmbJ-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss for za@test.ex
-1999-03-02 09:44:33 10HmbI-0005vi-00 => za@test.ex <mza@test.ex> R=mlist T=tmlist H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbJ-0005vi-00"
+1999-03-02 09:44:33 10HmbJ-0005vi-00 arc_state: <pass>
+1999-03-02 09:44:33 10HmbJ-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for mza@test.ex
+1999-03-02 09:44:33 10HmbI-0005vi-00 => mza@test.ex <zmza@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbJ-0005vi-00"
 1999-03-02 09:44:33 10HmbI-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 Start queue run: pid=pppp
 1999-03-02 09:44:33 10HmbK-0005vi-00 arc_state: <fail>
-1999-03-02 09:44:33 10HmbK-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss for a@test.ex
-1999-03-02 09:44:33 10HmbJ-0005vi-00 => a@test.ex <za@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbK-0005vi-00"
+1999-03-02 09:44:33 10HmbK-0005vi-00 reason:    <AMS body hash miscompare>
+1999-03-02 09:44:33 10HmbK-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss for za@test.ex
+1999-03-02 09:44:33 10HmbJ-0005vi-00 => za@test.ex <mza@test.ex> R=mlist T=tmlist H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbK-0005vi-00"
 1999-03-02 09:44:33 10HmbJ-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 10HmbK-0005vi-00 => a <a@test.ex> R=d1 T=tfile
+1999-03-02 09:44:33 10HmbL-0005vi-00 arc_state: <fail>
+1999-03-02 09:44:33 10HmbL-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss for a@test.ex
+1999-03-02 09:44:33 10HmbK-0005vi-00 => a@test.ex <za@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbL-0005vi-00"
 1999-03-02 09:44:33 10HmbK-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
-1999-03-02 09:44:33 10HmbL-0005vi-00 arc_state: <none>
-1999-03-02 09:44:33 10HmbL-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss for zza@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 10HmbM-0005vi-00 arc_state: <pass>
-1999-03-02 09:44:33 10HmbM-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for za@test.ex
-1999-03-02 09:44:33 10HmbL-0005vi-00 => za@test.ex <zza@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbM-0005vi-00"
+1999-03-02 09:44:33 10HmbL-0005vi-00 => a <a@test.ex> R=d1 T=tfile
 1999-03-02 09:44:33 10HmbL-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
+1999-03-02 09:44:33 10HmbM-0005vi-00 arc_state: <none>
+1999-03-02 09:44:33 10HmbM-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss for zza@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp
 1999-03-02 09:44:33 10HmbN-0005vi-00 arc_state: <pass>
-1999-03-02 09:44:33 10HmbN-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for a@test.ex
-1999-03-02 09:44:33 10HmbM-0005vi-00 => a@test.ex <za@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbN-0005vi-00"
+1999-03-02 09:44:33 10HmbN-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for za@test.ex
+1999-03-02 09:44:33 10HmbM-0005vi-00 => za@test.ex <zza@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbN-0005vi-00"
 1999-03-02 09:44:33 10HmbM-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 10HmbN-0005vi-00 => a <a@test.ex> R=d1 T=tfile
+1999-03-02 09:44:33 10HmbO-0005vi-00 arc_state: <pass>
+1999-03-02 09:44:33 10HmbO-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss ARC for a@test.ex
+1999-03-02 09:44:33 10HmbN-0005vi-00 => a@test.ex <za@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbO-0005vi-00"
 1999-03-02 09:44:33 10HmbN-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
-1999-03-02 09:44:33 10HmbO-0005vi-00 DKIM: d=dmarc.org s=clochette c=simple/simple a=rsa-sha256 b=1024 t=1517535263 [verification succeeded]
-1999-03-02 09:44:33 10HmbO-0005vi-00 DKIM: d=convivian.com s=default c=simple/simple a=rsa-sha256 b=1024 t=1517535248 [verification failed - body hash mismatch (body probably modified in transit)]
-1999-03-02 09:44:33 10HmbO-0005vi-00 arc_state: <fail>
-1999-03-02 09:44:33 10HmbO-0005vi-00 reason:    <AMS body hash miscompare>
-1999-03-02 09:44:33 10HmbO-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss DKIM=dmarc.org id=1426665656.110316.1517535248039.JavaMail.zimbra@convivian.com for za@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp
+1999-03-02 09:44:33 10HmbO-0005vi-00 => a <a@test.ex> R=d1 T=tfile
+1999-03-02 09:44:33 10HmbO-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 10HmbP-0005vi-00 DKIM: d=dmarc.org s=clochette c=simple/simple a=rsa-sha256 b=1024 t=1517535263 [verification succeeded]
 1999-03-02 09:44:33 10HmbP-0005vi-00 DKIM: d=convivian.com s=default c=simple/simple a=rsa-sha256 b=1024 t=1517535248 [verification failed - body hash mismatch (body probably modified in transit)]
 1999-03-02 09:44:33 10HmbP-0005vi-00 arc_state: <fail>
-1999-03-02 09:44:33 10HmbP-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss DKIM=dmarc.org id=1426665656.110316.1517535248039.JavaMail.zimbra@convivian.com for a@test.ex
-1999-03-02 09:44:33 10HmbO-0005vi-00 => a@test.ex <za@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbP-0005vi-00"
-1999-03-02 09:44:33 10HmbO-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbP-0005vi-00 reason:    <AMS body hash miscompare>
+1999-03-02 09:44:33 10HmbP-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss DKIM=dmarc.org id=1426665656.110316.1517535248039.JavaMail.zimbra@convivian.com for za@test.ex
+1999-03-02 09:44:33 Start queue run: pid=pppp
+1999-03-02 09:44:33 10HmbQ-0005vi-00 DKIM: d=dmarc.org s=clochette c=simple/simple a=rsa-sha256 b=1024 t=1517535263 [verification succeeded]
+1999-03-02 09:44:33 10HmbQ-0005vi-00 DKIM: d=convivian.com s=default c=simple/simple a=rsa-sha256 b=1024 t=1517535248 [verification failed - body hash mismatch (body probably modified in transit)]
+1999-03-02 09:44:33 10HmbQ-0005vi-00 arc_state: <fail>
+1999-03-02 09:44:33 10HmbQ-0005vi-00 <= CALLER@bloggs.com H=localhost (test.ex) [127.0.0.1] P=esmtp S=sss DKIM=dmarc.org id=1426665656.110316.1517535248039.JavaMail.zimbra@convivian.com for a@test.ex
+1999-03-02 09:44:33 10HmbP-0005vi-00 => a@test.ex <za@test.ex> R=fwd T=tsmtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbQ-0005vi-00"
+1999-03-02 09:44:33 10HmbP-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 10HmbP-0005vi-00 => a <a@test.ex> R=d1 T=tfile
-1999-03-02 09:44:33 10HmbP-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbQ-0005vi-00 => a <a@test.ex> R=d1 T=tfile
+1999-03-02 09:44:33 10HmbQ-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmbQ-0005vi-00 H=(xxx) [127.0.0.1] Warning: ARC-FAIL
-1999-03-02 09:44:33 10HmbQ-0005vi-00 arc_state: <none>
-1999-03-02 09:44:33 10HmbQ-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss for a@test.ex
+1999-03-02 09:44:33 10HmbR-0005vi-00 H=(xxx) [127.0.0.1] Warning: ARC-FAIL
+1999-03-02 09:44:33 10HmbR-0005vi-00 arc_state: <none>
+1999-03-02 09:44:33 10HmbR-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss for a@test.ex
diff --git a/test/mail/4560.a b/test/mail/4560.a
index 04e723698..4d3d3bde0 100644
--- a/test/mail/4560.a
+++ b/test/mail/4560.a
@@ -1,30 +1,58 @@
 From CALLER@bloggs.com Tue Mar 02 09:44:33 1999
 Authentication-Results: test.ex;
+	arc=pass (i=1) header.s=sel arc.oldest-pass=1 smtp.client-ip=127.0.0.1
+Received: from [127.0.0.1] (helo=xxx)
+	by test.ex with smtp (Exim x.yz)
+	(envelope-from <CALLER@bloggs.com>)
+	id 10HmaX-0005vi-00
+	for a@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+ARC-Seal: i=1; a=rsa-sha256; cv=none; d=test.ex; s=sel; t=1521752658; b=
+        xcIN0OEpAc3s8riODm31Q6JgmIECch3iVd1LXWwsypGpCY2UFFuo5HhCEf4a043q
+        YZ+zn/MbFFkvwIqleeQkJ7S5UcvfM8dv/V4YnwAe+JD8r79glh/FRq6uKlc0ixLS
+        CllJMwj98J1P1K9+gwmO5TrD1eTZV68caZj77P+X2kw=
+ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=test.ex;
+         h=from:to:date:message-id:subject; s=sel; bh=3UbbJTudPxmejzh7U1
+        Zg33U3QT+16kfV2eOTvMeiEis=; b=WgE+YWSm48w/P448gPlBBNCKt2SJ4gosPx
+        0JQ98aZJhun2RaVcUO3INc+kZv8YOijofMzFqJxVn1cgMjoU8/QSHIyyt40FzkQB
+        oSGmSrCjtRnzS8pbp491NX3kGuetidaWE5muPSdOystg6mm1rBnl9sqVrwaynCmr
+        fu2jTuUfw=
+ARC-Authentication-Results: i=1; test.ex; arc=none
+Authentication-Results: test.ex; arc=none
+From: mrgus@text.ex
+To: bakawolf@yahoo.com
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+Message-ID: <qwerty1234@disco-zombie.net>
+Subject: simple test
+
+This is a simple test.
+
+From CALLER@bloggs.com Tue Mar 02 09:44:33 1999
+Authentication-Results: test.ex;
 	iprev=pass (localhost);
 	arc=pass (i=1) header.s=sel arc.oldest-pass=1 smtp.client-ip=127.0.0.1
 Received: from localhost ([127.0.0.1] helo=test.ex)
 	by test.ex with esmtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmaY-0005vi-00
+	id 10HmaZ-0005vi-00
 	for a@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 ARC-Seal: i=1; cv=none; a=rsa-sha256; d=test.ex; s=sel;
-	 b=FUok5m+OoEqd8QIlc2ch4c9dWRBkoljL2vOaxOFd5V9JME/6PrlYQ8oF88sIAcMnrQyffjVtDA
-	  +kcb1AYzjO2TDaoH873Yu62CMTB6KBtC3+9B7eadXd24d3sNhTOxzJaK+TWid2iVNfEUU3rKXN
-	  mh1ISayCaAxP5vZXsxKJ7Sk=;
+	 b=DaGjkoR0m1B7KxZMbkzZFTviDSdrEf+VX4N7wo/f6PCDHEnt3fiIg646KrbgQHZQG23rVlPm72
+	  AaJMBhVpewKjPtdc/7fNY3Kgyp4ttwug8jMEGYU1cgaJjkx3Xp/HMk52b3HVnPvV900YNrmfGC
+	  s8DrtRVB3Tt8T/4g8L2SRY0=;
 ARC-Authentication-Results: i=1; test.ex;
 	arc=none
 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed; d=test.ex; s=sel;
 	bh=HUzfKKxIjPIa07lkj5uzDQ3q5YTRF/NwAUE7dhrrfvs=;
 	h=Subject;
-	b=CbJ1YQLNAWyRqMXq9y0WN10HlKn8Ylu+sVGztkUklgxaqQJCVKUiS7dZaKCBA0B7UqesGogzb5
-	  y1aeJRCnWnUSL1gKXCjalHTp9XuWxGjd5cARh0AN/nmkXOFkgcIan7o4vB3UBF/T3NwLdewza+
-	  caLY3oRoBpLwh0IBzibHKl0=;
+	b=HaqbXBWR7eLrt4KfDPd/G3iSS6Uc4tXEScE4sTS/xjR/poJETiM+Dz2DYWib1f3F7ryccIi7sE
+	  kwsTfpqQsHu/rwNs9X3WL0iW5fyTYeh4ruPd7ZvDmvRhiFJApW7wPejI5ZLCaYz4XWgzBeGKvm
+	  JAg9i5woZbwcXE/SLYOaw/I=;
 Authentication-Results: test.ex;
 	arc=none
 Received: from [127.0.0.1] (helo=xxx)
 	by test.ex with smtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmaX-0005vi-00
+	id 10HmaY-0005vi-00
 	for za@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 Subject: Test
 
@@ -37,47 +65,47 @@ Authentication-Results: test.ex;
 Received: from localhost ([127.0.0.1] helo=test.ex)
 	by test.ex with esmtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbB-0005vi-00
+	id 10HmbC-0005vi-00
 	for a@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 ARC-Seal: i=2; cv=pass; a=rsa-sha256; d=test.ex; s=sel;
-	 b=Gw0rnpSzWYrk0pESlvrgJ6U9Fv1r7BxNxp1uNw+OvylVt9JuuFEfTQ1+wJzu1RkJK9yctGI//X
-	  FiHjdEexgjjU38fOxWlVQyfhpPReuXs+dO0vHDfipIvIFuAkTXczUlRSRr+N+he6JTL33eDeFd
-	  mpyVa6MMt2CdB8mUulbMEdE=;
+	 b=yjlE1/MuuhrLFWK1L1/4OyMyvK47vEmb9dlUF0JGxKTUgJRTqd725Qqzv5ArRQDbCGDah3Pttx
+	  NfKYLDijgST4z5MSTQbiQAoXuGEIfwPSJjMm/cQ37FMcBA2l0gVLNoQIT6GlO8B0i4cigHGEZx
+	  fhUOLvI8pYW8KY8ZiBLY4qE=;
 ARC-Authentication-Results: i=2; test.ex;
 	iprev=pass (localhost);
 	arc=pass (i=1) header.s=sel arc.oldest-pass=1 smtp.client-ip=127.0.0.1
 ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed; d=test.ex; s=sel;
 	bh=HUzfKKxIjPIa07lkj5uzDQ3q5YTRF/NwAUE7dhrrfvs=;
 	h=Subject;
-	b=T2xYov0qVT77eX6s3g2M3CB4ulYuxbD0o+iTCpfB/40nZTzl5LdIVEyk2ph/ijyqY2PJTpBjjt
-	  iTHoJ4CBtVAkDwq75Wj+lh1OfrArWJatMyimkMwxX6b54KcXldIwB+7w6Tn3D9/sydBEduL82C
-	  p1kh+Bb/X0QGczb0CzdXwhM=;
+	b=MbmYcNxs4+glho4XUCPLvynpuuZJraZk6B+FDLYWKiNqqTeVjhIj6EnAsUACML3M6wj5d03DAr
+	  P4RkRsmKXqHCoaOiSOqLvBvc8822Ap0l7F/cT2Gk3VRR5ITZI2piAsgLzFpLOEJsGwGVdYsNdx
+	  5rxBKMPvXAWZip//tBngMRw=;
 Authentication-Results: test.ex;
 	iprev=pass (localhost);
 	arc=pass (i=1) header.s=sel arc.oldest-pass=1 smtp.client-ip=127.0.0.1
 Received: from localhost ([127.0.0.1] helo=test.ex)
 	by test.ex with esmtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbA-0005vi-00
+	id 10HmbB-0005vi-00
 	for za@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 ARC-Seal: i=1; cv=none; a=rsa-sha256; d=test.ex; s=sel;
-	 b=FUok5m+OoEqd8QIlc2ch4c9dWRBkoljL2vOaxOFd5V9JME/6PrlYQ8oF88sIAcMnrQyffjVtDA
-	  +kcb1AYzjO2TDaoH873Yu62CMTB6KBtC3+9B7eadXd24d3sNhTOxzJaK+TWid2iVNfEUU3rKXN
-	  mh1ISayCaAxP5vZXsxKJ7Sk=;
+	 b=DaGjkoR0m1B7KxZMbkzZFTviDSdrEf+VX4N7wo/f6PCDHEnt3fiIg646KrbgQHZQG23rVlPm72
+	  AaJMBhVpewKjPtdc/7fNY3Kgyp4ttwug8jMEGYU1cgaJjkx3Xp/HMk52b3HVnPvV900YNrmfGC
+	  s8DrtRVB3Tt8T/4g8L2SRY0=;
 ARC-Authentication-Results: i=1; test.ex;
 	arc=none
 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed; d=test.ex; s=sel;
 	bh=HUzfKKxIjPIa07lkj5uzDQ3q5YTRF/NwAUE7dhrrfvs=;
 	h=Subject;
-	b=CbJ1YQLNAWyRqMXq9y0WN10HlKn8Ylu+sVGztkUklgxaqQJCVKUiS7dZaKCBA0B7UqesGogzb5
-	  y1aeJRCnWnUSL1gKXCjalHTp9XuWxGjd5cARh0AN/nmkXOFkgcIan7o4vB3UBF/T3NwLdewza+
-	  caLY3oRoBpLwh0IBzibHKl0=;
+	b=HaqbXBWR7eLrt4KfDPd/G3iSS6Uc4tXEScE4sTS/xjR/poJETiM+Dz2DYWib1f3F7ryccIi7sE
+	  kwsTfpqQsHu/rwNs9X3WL0iW5fyTYeh4ruPd7ZvDmvRhiFJApW7wPejI5ZLCaYz4XWgzBeGKvm
+	  JAg9i5woZbwcXE/SLYOaw/I=;
 Authentication-Results: test.ex;
 	arc=none
 Received: from [127.0.0.1] (helo=xxx)
 	by test.ex with smtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmaZ-0005vi-00
+	id 10HmbA-0005vi-00
 	for zza@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 Subject: Test
 
@@ -90,68 +118,68 @@ Authentication-Results: test.ex;
 Received: from localhost ([127.0.0.1] helo=test.ex)
 	by test.ex with esmtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbF-0005vi-00
+	id 10HmbG-0005vi-00
 	for a@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 ARC-Seal: i=3; cv=pass; a=rsa-sha256; d=test.ex; s=sel;
-	 b=RcSJycBgTIQO9dOXE36ESKpl/550ykTZwQdtDPlGKaj4bZdbtSEeIRkdKOkwAwuQb+uSCGeaSH
-	  36LmxlBJzZ+hs8l7WoTEv/514qyEbaokW1DkfSDQ7IRsHOB0roVUliAIcbc7fiO9Fiuo4M1yIT
-	  asqHipuA9TCAMIeqO4QuyT4=;
+	 b=HfcLGHnX3KFIqq4Hj5/+WI4kkcNEpDCTHUbuLlB8PAdwgW2ZwwD2keARxqpkeFUz0KeedU/XZc
+	  54F5otXO+EkfzVP7l3nugFl4CAOGHqPOnXNU83o/tZmFb9OWDUpfB0AKN7pQZCcNbLaEdDjWuk
+	  YkuDNVDM0PBQ2EXpLCIbTrE=;
 ARC-Authentication-Results: i=3; test.ex;
 	iprev=pass (localhost);
 	arc=pass (i=2) header.s=sel arc.oldest-pass=0 smtp.client-ip=127.0.0.1
 ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed; d=test.ex; s=sel;
 	bh=31zA4VNQZ2yhHUh+7vWASIL9kKqo6pSym1QghgPyUkM=;
 	h=Subject;
-	b=Lf2jJs8SwbiYLrylYAOjQO4iIa+7tnGighj2gE5NWZj+SiJNQFgu+gHgkmA4xZc2meG58S7WPf
-	  nG6rkqTU/uqBRAbWaEHP1VYDss/x47a/GImRx89dR1P7ZTRLMGgk0AusbvtFDMsKvOTd8QeWLc
-	  DsScgtJ2MqYbikFuA0LxRIA=;
+	b=nnO3laDgWwUq0y1lOzltunxk1urdDH5ucui5FqCJSJDzvVRYsydYtlp7iayY4QQt9WtbCnvcOH
+	  Ke1FhjdC7iXPv/Dj86J40D9yib5y7YC9Ce3px0xJSXDD+ml1eDi45rVo9GDkm1zVG3eZdESktT
+	  Iv0EvpWIFn7dpelS30IKk78=;
 Authentication-Results: test.ex;
 	iprev=pass (localhost);
 	arc=pass (i=2) header.s=sel arc.oldest-pass=0 smtp.client-ip=127.0.0.1
 Received: from localhost ([127.0.0.1] helo=test.ex)
 	by test.ex with esmtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbE-0005vi-00
+	id 10HmbF-0005vi-00
 	for za@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 ARC-Seal: i=2; cv=pass; a=rsa-sha256; d=test.ex; s=sel;
-	 b=PisKqTHCNjT5OBFxx3tSp8wLuNXxL9kN8owfn6ueRBSUjWjRx/GFUpa/gPut04/qcTt8MHvamq
-	  rG8f6KBkoD4D8+zZrE9J13RI0v2vR3DUSdhzGjAHRwyAIWaHm7lvu3R5ze6GF0vHmtvFZpApCa
-	  hbMYARUVb7VvXJAhQdLE3oE=;
+	 b=l/OY+REy6qXxE2df0mxzk2Fyv4C9dTuIr2GfnpylYmIr2m/9a8uJRahXa7Ygk9wR8ofnJS+7mr
+	  PTM33+jhCQidq7ZgE28Q7XVMPGmqE4Frs+OmzIL4j7UpK1CYktEzYwOOCSAf8/Yu1XH5w2XNqA
+	  rfIrGPWlAcSoxwfnbyYxVXQ=;
 ARC-Authentication-Results: i=2; test.ex;
 	iprev=pass (localhost);
 	arc=pass (i=1) header.s=sel arc.oldest-pass=1 smtp.client-ip=127.0.0.1
 ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed; d=test.ex; s=sel;
 	bh=31zA4VNQZ2yhHUh+7vWASIL9kKqo6pSym1QghgPyUkM=;
 	h=Subject;
-	b=v3N5ukPvIJskEefYQVq9la9YvMbtrEETkzRVbExhcuf52gWH6PY6L8MWQr2BN4VZbWHPIfZN3S
-	  GMQ21ewl0ZaHC4bAzidgK7NsViw8cfKnJwkvSm4FejpBDto93vQ0Jn2dntbjGZeDSaFx8AuV0m
-	  oZRTJp3w8FnuMJ8Pl0bDLDM=;
+	b=SBrsiAzbKlKDKB7we5Z0VxUcWT/uiE6YpMtePFkyQ5vR/lD0AooKmluD1HxMGonlbz8WXcwa1C
+	  Avoox5GkxPCBgYfO6wzh801k7F12Usgo7ryY8lOgQ/4OQ77TawNHFnlQ1WxhpaR/lUYkTXZXm2
+	  LDzSoSVOQ0uFYg3cFzp54OA=;
 Authentication-Results: test.ex;
 	iprev=pass (localhost);
 	arc=pass (i=1) header.s=sel arc.oldest-pass=1 smtp.client-ip=127.0.0.1
 Received: from localhost ([127.0.0.1] helo=test.ex)
 	by test.ex with esmtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbD-0005vi-00
+	id 10HmbE-0005vi-00
 	for mza@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 ARC-Seal: i=1; cv=none; a=rsa-sha256; d=test.ex; s=sel;
-	 b=FUok5m+OoEqd8QIlc2ch4c9dWRBkoljL2vOaxOFd5V9JME/6PrlYQ8oF88sIAcMnrQyffjVtDA
-	  +kcb1AYzjO2TDaoH873Yu62CMTB6KBtC3+9B7eadXd24d3sNhTOxzJaK+TWid2iVNfEUU3rKXN
-	  mh1ISayCaAxP5vZXsxKJ7Sk=;
+	 b=DaGjkoR0m1B7KxZMbkzZFTviDSdrEf+VX4N7wo/f6PCDHEnt3fiIg646KrbgQHZQG23rVlPm72
+	  AaJMBhVpewKjPtdc/7fNY3Kgyp4ttwug8jMEGYU1cgaJjkx3Xp/HMk52b3HVnPvV900YNrmfGC
+	  s8DrtRVB3Tt8T/4g8L2SRY0=;
 ARC-Authentication-Results: i=1; test.ex;
 	arc=none
 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed; d=test.ex; s=sel;
 	bh=HUzfKKxIjPIa07lkj5uzDQ3q5YTRF/NwAUE7dhrrfvs=;
 	h=Subject;
-	b=CbJ1YQLNAWyRqMXq9y0WN10HlKn8Ylu+sVGztkUklgxaqQJCVKUiS7dZaKCBA0B7UqesGogzb5
-	  y1aeJRCnWnUSL1gKXCjalHTp9XuWxGjd5cARh0AN/nmkXOFkgcIan7o4vB3UBF/T3NwLdewza+
-	  caLY3oRoBpLwh0IBzibHKl0=;
+	b=HaqbXBWR7eLrt4KfDPd/G3iSS6Uc4tXEScE4sTS/xjR/poJETiM+Dz2DYWib1f3F7ryccIi7sE
+	  kwsTfpqQsHu/rwNs9X3WL0iW5fyTYeh4ruPd7ZvDmvRhiFJApW7wPejI5ZLCaYz4XWgzBeGKvm
+	  JAg9i5woZbwcXE/SLYOaw/I=;
 Authentication-Results: test.ex;
 	arc=none
 Received: from [127.0.0.1] (helo=xxx)
 	by test.ex with smtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbC-0005vi-00
+	id 10HmbD-0005vi-00
 	for zmza@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 Subject: Test
 
@@ -168,28 +196,28 @@ Authentication-Results: test.ex;
 Received: from localhost ([127.0.0.1] helo=test.ex)
 	by test.ex with esmtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbK-0005vi-00
+	id 10HmbL-0005vi-00
 	for a@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 ARC-Seal: i=3; cv=fail; a=rsa-sha256; d=test.ex; s=sel;
-	 b=cdGeRgKBXmi4ZuxBGCLHkZN5io4rurCl7k7ESImcC4FcQFq1giqpFeD2lipCeWvSpx9FpRbXCI
-	  OQyRZB3ZVbjSsuacqUWz78Y5Z15M6g/OrNRwC+wLyGI/Dfg1jwJCp7dtxUMvOfvX/fnII57Y9D
-	  ULyV72U2yGs4E+khjk2Fgdw=;
+	 b=kz0kMxmRu3kimu9tZvLx4HCAt6Scs+hbhEjjE30exA6FCQtaT9UjBekWGRtMLFSmR7CBlRRmOq
+	  Rl6lWMahfAvmdnLVKyX2FrfQLiCGBadOFeZVv5uGX0sdZXDqgjGJLGlNfnk1dtP/y4durC28LL
+	  8PiM7An58gtCVWyiygt1Qk4=;
 ARC-Authentication-Results: i=3; test.ex;
 	iprev=pass (localhost);
 	arc=fail (i=2)(AMS body hash miscompare) header.s=sel arc.oldest-pass=0 smtp.client-ip=127.0.0.1
 ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed; d=test.ex; s=sel;
 	bh=31zA4VNQZ2yhHUh+7vWASIL9kKqo6pSym1QghgPyUkM=;
 	h=Subject;
-	b=Lf2jJs8SwbiYLrylYAOjQO4iIa+7tnGighj2gE5NWZj+SiJNQFgu+gHgkmA4xZc2meG58S7WPf
-	  nG6rkqTU/uqBRAbWaEHP1VYDss/x47a/GImRx89dR1P7ZTRLMGgk0AusbvtFDMsKvOTd8QeWLc
-	  DsScgtJ2MqYbikFuA0LxRIA=;
+	b=nnO3laDgWwUq0y1lOzltunxk1urdDH5ucui5FqCJSJDzvVRYsydYtlp7iayY4QQt9WtbCnvcOH
+	  Ke1FhjdC7iXPv/Dj86J40D9yib5y7YC9Ce3px0xJSXDD+ml1eDi45rVo9GDkm1zVG3eZdESktT
+	  Iv0EvpWIFn7dpelS30IKk78=;
 Authentication-Results: test.ex;
 	iprev=pass (localhost);
 	arc=fail (i=2)(AMS body hash miscompare) header.s=sel arc.oldest-pass=0 smtp.client-ip=127.0.0.1
 Received: from localhost ([127.0.0.1] helo=test.ex)
 	by test.ex with esmtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbJ-0005vi-00
+	id 10HmbK-0005vi-00
 	for za@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 Authentication-Results: test.ex;
 	iprev=pass (localhost);
@@ -197,47 +225,47 @@ Authentication-Results: test.ex;
 Received: from localhost ([127.0.0.1] helo=test.ex)
 	by test.ex with esmtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbI-0005vi-00
+	id 10HmbJ-0005vi-00
 	for mza@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 ARC-Seal: i=2; cv=pass; a=rsa-sha256; d=test.ex; s=sel;
-	 b=Gw0rnpSzWYrk0pESlvrgJ6U9Fv1r7BxNxp1uNw+OvylVt9JuuFEfTQ1+wJzu1RkJK9yctGI//X
-	  FiHjdEexgjjU38fOxWlVQyfhpPReuXs+dO0vHDfipIvIFuAkTXczUlRSRr+N+he6JTL33eDeFd
-	  mpyVa6MMt2CdB8mUulbMEdE=;
+	 b=yjlE1/MuuhrLFWK1L1/4OyMyvK47vEmb9dlUF0JGxKTUgJRTqd725Qqzv5ArRQDbCGDah3Pttx
+	  NfKYLDijgST4z5MSTQbiQAoXuGEIfwPSJjMm/cQ37FMcBA2l0gVLNoQIT6GlO8B0i4cigHGEZx
+	  fhUOLvI8pYW8KY8ZiBLY4qE=;
 ARC-Authentication-Results: i=2; test.ex;
 	iprev=pass (localhost);
 	arc=pass (i=1) header.s=sel arc.oldest-pass=1 smtp.client-ip=127.0.0.1
 ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed; d=test.ex; s=sel;
 	bh=HUzfKKxIjPIa07lkj5uzDQ3q5YTRF/NwAUE7dhrrfvs=;
 	h=Subject;
-	b=T2xYov0qVT77eX6s3g2M3CB4ulYuxbD0o+iTCpfB/40nZTzl5LdIVEyk2ph/ijyqY2PJTpBjjt
-	  iTHoJ4CBtVAkDwq75Wj+lh1OfrArWJatMyimkMwxX6b54KcXldIwB+7w6Tn3D9/sydBEduL82C
-	  p1kh+Bb/X0QGczb0CzdXwhM=;
+	b=MbmYcNxs4+glho4XUCPLvynpuuZJraZk6B+FDLYWKiNqqTeVjhIj6EnAsUACML3M6wj5d03DAr
+	  P4RkRsmKXqHCoaOiSOqLvBvc8822Ap0l7F/cT2Gk3VRR5ITZI2piAsgLzFpLOEJsGwGVdYsNdx
+	  5rxBKMPvXAWZip//tBngMRw=;
 Authentication-Results: test.ex;
 	iprev=pass (localhost);
 	arc=pass (i=1) header.s=sel arc.oldest-pass=1 smtp.client-ip=127.0.0.1
 Received: from localhost ([127.0.0.1] helo=test.ex)
 	by test.ex with esmtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbH-0005vi-00
+	id 10HmbI-0005vi-00
 	for zmza@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 ARC-Seal: i=1; cv=none; a=rsa-sha256; d=test.ex; s=sel;
-	 b=FUok5m+OoEqd8QIlc2ch4c9dWRBkoljL2vOaxOFd5V9JME/6PrlYQ8oF88sIAcMnrQyffjVtDA
-	  +kcb1AYzjO2TDaoH873Yu62CMTB6KBtC3+9B7eadXd24d3sNhTOxzJaK+TWid2iVNfEUU3rKXN
-	  mh1ISayCaAxP5vZXsxKJ7Sk=;
+	 b=DaGjkoR0m1B7KxZMbkzZFTviDSdrEf+VX4N7wo/f6PCDHEnt3fiIg646KrbgQHZQG23rVlPm72
+	  AaJMBhVpewKjPtdc/7fNY3Kgyp4ttwug8jMEGYU1cgaJjkx3Xp/HMk52b3HVnPvV900YNrmfGC
+	  s8DrtRVB3Tt8T/4g8L2SRY0=;
 ARC-Authentication-Results: i=1; test.ex;
 	arc=none
 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed; d=test.ex; s=sel;
 	bh=HUzfKKxIjPIa07lkj5uzDQ3q5YTRF/NwAUE7dhrrfvs=;
 	h=Subject;
-	b=CbJ1YQLNAWyRqMXq9y0WN10HlKn8Ylu+sVGztkUklgxaqQJCVKUiS7dZaKCBA0B7UqesGogzb5
-	  y1aeJRCnWnUSL1gKXCjalHTp9XuWxGjd5cARh0AN/nmkXOFkgcIan7o4vB3UBF/T3NwLdewza+
-	  caLY3oRoBpLwh0IBzibHKl0=;
+	b=HaqbXBWR7eLrt4KfDPd/G3iSS6Uc4tXEScE4sTS/xjR/poJETiM+Dz2DYWib1f3F7ryccIi7sE
+	  kwsTfpqQsHu/rwNs9X3WL0iW5fyTYeh4ruPd7ZvDmvRhiFJApW7wPejI5ZLCaYz4XWgzBeGKvm
+	  JAg9i5woZbwcXE/SLYOaw/I=;
 Authentication-Results: test.ex;
 	arc=none
 Received: from [127.0.0.1] (helo=xxx)
 	by test.ex with smtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbG-0005vi-00
+	id 10HmbH-0005vi-00
 	for zzmza@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 Subject: Test
 
@@ -254,7 +282,7 @@ Authentication-Results: test.ex;
 Received: from localhost ([127.0.0.1] helo=test.ex)
 	by test.ex with esmtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbN-0005vi-00
+	id 10HmbO-0005vi-00
 	for a@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 Authentication-Results: test.ex;
 	iprev=pass (localhost);
@@ -262,26 +290,26 @@ Authentication-Results: test.ex;
 Received: from localhost ([127.0.0.1] helo=test.ex)
 	by test.ex with esmtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbM-0005vi-00
+	id 10HmbN-0005vi-00
 	for za@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 ARC-Seal: i=1; cv=none; a=rsa-sha256; d=test.ex; s=sel;
-	 b=FUok5m+OoEqd8QIlc2ch4c9dWRBkoljL2vOaxOFd5V9JME/6PrlYQ8oF88sIAcMnrQyffjVtDA
-	  +kcb1AYzjO2TDaoH873Yu62CMTB6KBtC3+9B7eadXd24d3sNhTOxzJaK+TWid2iVNfEUU3rKXN
-	  mh1ISayCaAxP5vZXsxKJ7Sk=;
+	 b=DaGjkoR0m1B7KxZMbkzZFTviDSdrEf+VX4N7wo/f6PCDHEnt3fiIg646KrbgQHZQG23rVlPm72
+	  AaJMBhVpewKjPtdc/7fNY3Kgyp4ttwug8jMEGYU1cgaJjkx3Xp/HMk52b3HVnPvV900YNrmfGC
+	  s8DrtRVB3Tt8T/4g8L2SRY0=;
 ARC-Authentication-Results: i=1; test.ex;
 	arc=none
 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed; d=test.ex; s=sel;
 	bh=HUzfKKxIjPIa07lkj5uzDQ3q5YTRF/NwAUE7dhrrfvs=;
 	h=Subject;
-	b=CbJ1YQLNAWyRqMXq9y0WN10HlKn8Ylu+sVGztkUklgxaqQJCVKUiS7dZaKCBA0B7UqesGogzb5
-	  y1aeJRCnWnUSL1gKXCjalHTp9XuWxGjd5cARh0AN/nmkXOFkgcIan7o4vB3UBF/T3NwLdewza+
-	  caLY3oRoBpLwh0IBzibHKl0=;
+	b=HaqbXBWR7eLrt4KfDPd/G3iSS6Uc4tXEScE4sTS/xjR/poJETiM+Dz2DYWib1f3F7ryccIi7sE
+	  kwsTfpqQsHu/rwNs9X3WL0iW5fyTYeh4ruPd7ZvDmvRhiFJApW7wPejI5ZLCaYz4XWgzBeGKvm
+	  JAg9i5woZbwcXE/SLYOaw/I=;
 Authentication-Results: test.ex;
 	arc=none
 Received: from [127.0.0.1] (helo=xxx)
 	by test.ex with smtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbL-0005vi-00
+	id 10HmbM-0005vi-00
 	for zza@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 Subject: Test
 
@@ -297,12 +325,12 @@ Authentication-Results: test.ex;
 Received: from localhost ([127.0.0.1] helo=test.ex)
 	by test.ex with esmtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbP-0005vi-00
+	id 10HmbQ-0005vi-00
 	for a@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 ARC-Seal: i=2; cv=fail; a=rsa-sha256; d=test.ex; s=sel;
-	 b=bID/N3wfd1l6ac20RCPn+pVvXigyjdZRMuub+N4VGA/c6Nw41LDmhgxEHqSUhNxri2KYGV3BPw
-	  Qp9RWx7lS2o6nnrrKBi/tdlE164GWpFNH5qetZZKuaEtZ0box3qUNwMpjzZZOhHNPzDXsztTLG
-	  M4/bKjEuvxwND7oliqhn3mg=;
+	 b=cTfJCdk2kBIo+p9qyn5XD99OoJsGq5B2olKU9zbU2P7YrfsGYva+utsBO1hI4jAHUfJj191WV/
+	  YuxNGgTxlBHZxmKOEj4QeHSgYNXRx/0iJKFLGPX3k/oNFcjD2L35YhtpEfctsRawU3wU8QMm05
+	  m516OWV1S6tg0YR9MtS7kMc=;
 ARC-Authentication-Results: i=2; test.ex;
 	dkim=pass header.d=dmarc.org header.s=clochette header.a=rsa-sha256;
 	dkim=fail (body hash mismatch; body probably modified in transit)
@@ -313,9 +341,9 @@ ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed; d=test.ex; s=sel;
 	h=Sender:Content-Type:Reply-To:From:List-Subscribe:List-Help:List-Post:
 	  List-Archive:List-Unsubscribe:List-Id:Subject:Cc:MIME-Version:References:
 	  In-Reply-To:Message-ID:To:Date:DKIM-Signature:DKIM-Signature;
-	b=ZDh/1Pns8xp2aOFUIDqAIU8rNK+Wx+xBtsUqn+P8an0dPJIja0AexTNoPagabvXjNzT86Uf6dm
-	  6gO1oFpzn63XNNaRJSrUDOMLe3pe5D8IS/0AFlqU9iwyDjmZqsnc8VnxXMgkDvEhrF5e1Mj9E+
-	  Rw80B9DQMRhl1Va7HMZsLlI=;
+	b=m3z/6RMe+O4S3C647SM44td4xa+4BtIPQXbP+SJfmXrB/eNcbm2PlOGzdGALfrNJ1IkwDl3waA
+	  nQwOSOgmNvyYQyrYcZZu7A2+y4NtjhXAyaAwhd/tp+PcMH52/wSXkMJKRwppbmROo89TtABsOE
+	  CW1KtSgWheAYLf32Mhhws20=;
 Authentication-Results: test.ex;
 	dkim=pass header.d=dmarc.org header.s=clochette header.a=rsa-sha256;
 	dkim=fail (body hash mismatch; body probably modified in transit)
@@ -324,7 +352,7 @@ Authentication-Results: test.ex;
 Received: from [127.0.0.1] (helo=xxx)
 	by test.ex with smtp (Exim x.yz)
 	(envelope-from <CALLER@bloggs.com>)
-	id 10HmbO-0005vi-00
+	id 10HmbP-0005vi-00
 	for za@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 Received: from dragon.trusteddomain.org (localhost [127.0.0.1])
 	by dragon.trusteddomain.org (8.14.5/8.14.5) with ESMTP id w121YG2q036577;
diff --git a/test/scripts/4560-ARC/4560 b/test/scripts/4560-ARC/4560
index 3e0f8e922..1a0086f47 100644
--- a/test/scripts/4560-ARC/4560
+++ b/test/scripts/4560-ARC/4560
@@ -3,6 +3,48 @@
 exim -DSERVER=server -bd -oX PORT_D
 ****
 #
+# This should pass.
+# Mail original in aux-fixed/4560.msg1.txt
+# Sig generated by: perl aux-fixed/dkim/sign_arc.pl < aux-fixed/4560.msg1.txt
+client 127.0.0.1 PORT_D
+??? 220
+HELO xxx
+??? 250
+MAIL FROM:<CALLER@bloggs.com>
+??? 250
+RCPT TO:<a@test.ex>
+??? 250
+DATA
+??? 354
+ARC-Seal: i=1; a=rsa-sha256; cv=none; d=test.ex; s=sel; t=1521752658; b=
+        xcIN0OEpAc3s8riODm31Q6JgmIECch3iVd1LXWwsypGpCY2UFFuo5HhCEf4a043q
+        YZ+zn/MbFFkvwIqleeQkJ7S5UcvfM8dv/V4YnwAe+JD8r79glh/FRq6uKlc0ixLS
+        CllJMwj98J1P1K9+gwmO5TrD1eTZV68caZj77P+X2kw=
+ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=test.ex;
+         h=from:to:date:message-id:subject; s=sel; bh=3UbbJTudPxmejzh7U1
+        Zg33U3QT+16kfV2eOTvMeiEis=; b=WgE+YWSm48w/P448gPlBBNCKt2SJ4gosPx
+        0JQ98aZJhun2RaVcUO3INc+kZv8YOijofMzFqJxVn1cgMjoU8/QSHIyyt40FzkQB
+        oSGmSrCjtRnzS8pbp491NX3kGuetidaWE5muPSdOystg6mm1rBnl9sqVrwaynCmr
+        fu2jTuUfw=
+ARC-Authentication-Results: i=1; test.ex; arc=none
+Authentication-Results: test.ex; arc=none
+From: mrgus@text.ex
+To: bakawolf@yahoo.com
+Date: Thu, 19 Nov 2015 17:00:07 -0700
+Message-ID: <qwerty1234@disco-zombie.net>
+Subject: simple test
+
+This is a simple test.
+.
+??? 250
+QUIT
+??? 221
+****
+exim -DSERVER=server -DNOTDAEMON -q
+****
+#
+#
+#
 # We send this one through one forwarding hop.
 # It starts off bare, so the forwarder reception gets an ARC status of "none".
 # The outbound signs it with that, and the final receiver is happy to pass it.