ARC (Authenticated Received Chain), defined in RFC 8617, is a protocol that records the authentication results a message had when it arrived at an intermediary, so a later receiver can see them even after forwarding has broken the original signatures. It exists because mailing lists and forwarders often modify messages, which invalidates DKIM and breaks SPF alignment, causing otherwise genuine mail to fail DMARC.
ARC works by having each hop add three header fields: an ARC-Authentication-Results header capturing the authentication results it observed, an ARC-Message-Signature over the message, and an ARC-Seal that cryptographically chains the current hop to all previous ones. Together these form a tamper-evident chain. A receiver that trusts the sealing intermediary can use the preserved results to make a delivery decision rather than rejecting outright.
ARC does not replace DMARC and it does not force acceptance; it is advisory. Each receiver decides whether to honour a given sealer. For domain owners, ARC mostly works behind the scenes at large mailbox providers, so there is little to configure on your own domain. The practical takeaway is that forwarding-related DMARC failures are expected, and reviewing your aggregate reports helps you tell forwarding from genuine abuse.
Check it on your domain
- Email Header Analyser: parse raw email headers and trace the delivery path.
- DMARC Report Analyser: read a DMARC aggregate (RUA) report in plain English.