ARC (Authenticated Received Chain) is a protocol that lets a server which modifies or forwards a message sign a record of the SPF, DKIM and DMARC results it saw on arrival. The final receiver can then verify that chain.
Why it matters
Forwarding and mailing lists often break authentication: the forwarder's IP is not in the original SPF record, and list footers or subject tags invalidate the DKIM signature. A strict DMARC policy would then reject legitimate mail. ARC adds three headers per hop (ARC-Authentication-Results, ARC-Message-Signature, ARC-Seal) that preserve the original verdicts. Receivers decide which ARC sealers they trust; ARC does not override DMARC on its own.
Example
A message passes through a list server. Its headers include:
ARC-Authentication-Results: i=1; lists.example.org; dkim=pass; spf=pass; dmarc=pass
ARC-Seal: i=1; a=rsa-sha256; cv=none; d=lists.example.org; s=arc; ...The next hop can verify the seal and, if it trusts lists.example.org, accept the message even though DKIM now fails after the footer was added.
Common misconceptions
- ARC fixes broken DKIM or SPF. It only records earlier results.
- Every receiver honours ARC; support and trust are provider-specific.
- Senders need to publish anything for ARC. The sealing is done by intermediaries.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.