ARC
Authenticated Received Chain: signed headers in which each server that handles a message records the authentication results it saw, so later receivers can trust results that forwarding broke.
What it means
Forwarders and mailing lists break SPF (new sending IP address) and often DKIM (edited subject or footer), so legitimate mail fails DMARC at the final receiver. ARC, defined in experimental RFC 8617 (2019), lets each intermediary add an ARC set of three headers: ARC-Authentication-Results with what it observed, ARC-Message-Signature over the message as it forwards it, and ARC-Seal over the chain so far. Sets are numbered with i=1, 2, 3, up to 50.
A final receiver that validates the chain and trusts the sealers may use the earliest recorded results to accept mail that now fails DMARC. ARC tells a receiver what happened; whether to rely on it is the receiver's decision, based on whom it trusts.
Google documents ARC as the way forwarded mail keeps its SPF and DKIM results, and Microsoft 365 lets administrators name trusted ARC sealers.
Example
ARC-Seal: i=1; a=rsa-sha256; t=1792540800; cv=none; d=lists.example.org; s=arc2026; b=...Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 8617: The Authenticated Received Chain (ARC) Protocolrfc-editor.org
- Google Workspace Admin Help: ARC email authenticationknowledge.workspace.google.com
- Microsoft Learn: Configure trusted ARC sealerslearn.microsoft.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes