ARC-Message-Signature
The ARC header in which an intermediary signs the message, headers and body, as it passes it on, much like a DKIM signature.
What it means
The ARC-Message-Signature (AMS) uses the same syntax and meaning as a DKIM-Signature, with three differences: its name, no v= tag, and i= holding the ARC instance number instead of a user identifier. The handler adds it as the message leaves, so its own changes are covered.
It must not sign Authentication-Results or other ARC headers, and should include any DKIM-Signature headers already present. RFC 8617 puts no requirement on the domain or selector used, so it need not align with anything.
A later handler verifies the most recent AMS to confirm the message has not changed since the last hop.
Example
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.example.org; s=arc2026; h=from:to:subject:date:message-id; bh=...; b=...Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 8617: The Authenticated Received Chain (ARC) Protocol, section 4.1.2rfc-editor.org
- Google Workspace Admin Help: ARC email authenticationknowledge.workspace.google.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes