ARC

ARC (Authenticated Received Chain) is an email authentication protocol, standardized in RFC 8617, that solves a well-known blind spot of SPF and DKIM: their results break whenever a message travels through an intermediary. A mailbox forwarding rule changes the sending server, so SPF fails; a mailing list that adds a footer or rewrites the subject invalidates the DKIM signature. The message is perfectly legitimate, yet by the time it reaches the final server, every proof of that has been destroyed. ARC lets each intermediary attest to the authentication state it observed and pass that attestation along in a tamper-evident chain.

How ARC works

Every ARC-aware hop adds a set of three headers to the message:

• ARC-Authentication-Results (AAR) — a snapshot of the SPF, DKIM and DMARC results at the moment the hop received the message;
• ARC-Message-Signature (AMS) — a DKIM-style cryptographic signature over the message as this hop forwards it;
• ARC-Seal (AS) — a signature covering all previous ARC headers, binding the chain together.

Hops are numbered with an instance tag (i=1, i=2, …). The final receiver validates the whole chain backwards: if every seal is intact and the earliest hop recorded passing SPF or DKIM, the receiver may accept the message even though direct DMARC evaluation fails — a documented local-policy override.

Practical application

ARC is implemented mainly by large mailbox providers (Gmail, Microsoft 365), forwarding services and mailing-list software. Domain owners do not publish any ARC record in DNS; their job remains a correct SPF + DKIM + DMARC setup. Administrators running their own mail servers, however, should care: if a server forwards customer mailboxes to external addresses, enabling ARC signing (available in Rspamd, OpenARC and similar milters) markedly improves the odds that forwarded mail from strict p=reject domains reaches the destination instead of bouncing. In short, ARC is plumbing for the middlemen of email — invisible when it works, and painfully visible in lost mail when it is missing.