What Is ARC in Email? (Authenticated Received Chain Explained)

ARC in 30 Seconds

ARC solves the email forwarding problem. When you forward an email, SPF breaks (wrong IP) and DKIM may break (message modified). ARC preserves the original authentication results in a chain of trust, so the final destination can still verify the email is legitimate.

The Forwarding Problem

Without ARC:

1. Sender sends email → SPF pass, DKIM pass, DMARC pass
2. Email hits a mailing list or forwarding rule
3. Mailing list re-sends from its own IP → SPF fails
4. Mailing list adds a footer → DKIM fails
5. Final receiver sees both fail → DMARC fails → spam or rejection

With ARC:

1. Same as above, but the mailing list adds ARC headers recording the original pass results
2. Final receiver checks the ARC chain → sees original authentication passed
3. If the intermediary is trusted → DMARC is overridden → delivered

ARC Headers

ARC adds three headers at each hop, each with an instance number (i=):

ARC-Authentication-Results: i=1; mx.google.com;
    dkim=pass header.d=example.com;
    spf=pass smtp.mailfrom=example.com;
    dmarc=pass header.from=example.com
    
ARC-Message-Signature: i=1; a=rsa-sha256; d=google.com; ...

ARC-Seal: i=1; a=rsa-sha256; d=google.com; cv=none; ...

• ARC-Authentication-Results — what the intermediary observed
• ARC-Message-Signature — the intermediary's signature of the message
• ARC-Seal — the intermediary's signature of the entire ARC chain (cv= shows chain validation status)

Who Needs ARC

Senders: You don't need to configure anything for ARC. It's handled by intermediaries and receivers.

Intermediaries (mailing lists, forwarding services): If you operate any service that forwards email, implementing ARC signing helps forwarded messages maintain authentication. Read more about ARC and email forwarding.

Receivers: Major providers (Gmail, Microsoft, Yahoo) already evaluate ARC chains from trusted intermediaries.

Practitioner note: ARC doesn't solve everything. It depends on the receiver trusting the intermediary — and trust lists are maintained privately by each provider. If your email is forwarded through an unknown intermediary, ARC headers may be present but ignored.

Practitioner note: I see ARC confusion in DMARC reports constantly. Clients see DMARC failures from Google or Microsoft IPs and panic, but it's just forwarded email. The ARC chain is handling it — the failures in the aggregate report are informational, not necessarily causing spam placement.

If you run a mailing list or forwarding service and need ARC implementation guidance, schedule a consultation.

Sources

• RFC 8617: The Authenticated Received Chain (ARC) Protocol
• Google: ARC Authentication for email
• DMARC.org: Interoperability Issues Between DMARC and Mailing Lists
• M3AAWG: Recommendations for Senders of ARC-Signed Mail

---

v1.0 · April 2026