ARC-Seal
The ARC header that signs a handler's ARC headers and all earlier ARC sets, carrying the chain validation status cv= of none, pass or fail.
What it means
The ARC-Seal binds each intermediary's evidence into a chain of custody. Its signature covers only ARC headers, never the body, using relaxed header canonicalization and no h= tag. Its tags are i (the instance), a, b, d, s and t from DKIM, plus cv.
cv= records what the sealer found when the message arrived: none if there was no earlier chain (always the case for i=1), pass if the chain validated, fail if it did not. Once a chain is broken it cannot be continued or repaired by later handlers.
When reading headers, the cv= values and the d= of each seal tell you who handled the message and whether the chain held.
Example
ARC-Seal: i=2; a=rsa-sha256; t=1792540900; cv=pass; d=forwarder.example.net; s=arc1; b=...Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 8617: The Authenticated Received Chain (ARC) Protocol, section 4.1.3rfc-editor.org
- RFC 8617: The Authenticated Received Chain (ARC) Protocol, section 4.4rfc-editor.org
- RFC 8617: The Authenticated Received Chain (ARC) Protocol, section 5.1.3rfc-editor.org
- Google Workspace Admin Help: ARC email authenticationknowledge.workspace.google.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes