Definition
ARC, or Authenticated Received Chain, is an email standard (RFC 8617) that preserves authentication results as a message passes through intermediaries such as mailing lists and forwarders. Because forwarding often breaks SPF and can alter content, a recipient might otherwise see authentication failures that are not the sender's fault. The ARC chain records the authentication status at each hop so downstream receivers can trust the original results.
How It Works
ARC adds a set of three headers at each participating intermediary:
| Header | Purpose |
|---|---|
| ARC-Authentication-Results | Records the SPF and DKIM results as seen at that hop |
| ARC-Message-Signature | Signs the message to bind the results to its content |
| ARC-Seal | Chains the current results to the previous seal, forming a verifiable sequence |
When a mailing list receives a message, it performs authentication, records the results, signs them, and seals them together. The next hop can inspect the chain, verify the seals, and determine whether the original message was authenticated before forwarding occurred. This prevents forwarding from being mistaken for email spoofing.
Why It Matters
ARC solves a real-world conflict between authentication and legitimate forwarding. A message that passes DKIM and DMARC at the origin can fail SPF after a forwarder changes the return path, which would normally look like forgery. With ARC, the recipient can see the authentic chain and avoid penalising a legitimate sender.
ARC is also relevant to senders whose mail passes through intermediaries:
- Mailing list operators use ARC to preserve their members' authentication results.
- Large forwarders and filters use it to signal that changes were legitimate.
- AOL and other early adopters helped establish ARC as a way to protect authenticated mail from being misclassified.
For a sender, ARC means authentication can survive transit through systems beyond the sender's control, improving the consistency of email authentication results.
Example
A subscriber receives a newsletter through a mailing list. The list server forwards the message, changing the return path so SPF fails at the final mailbox. Because the list adds ARC headers recording the original DKIM pass, the receiving provider sees the chain and delivers the message to the inbox instead of flagging it as spoofed.
Was this useful?
Related Glossary Terms
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
Alt Text
Alt text is the written alternative to an image in an email, displayed when images are blocked, slow to load, or consumed by screen readers.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Management
Bounce management is the process of handling emails that are rejected by mailbox providers, including classification, removal of bad addresses and protection of sender reputation.
Frequently Asked Questions
DKIM signs a message at the origin to authenticate the sender. ARC records and seals authentication results across multiple hops, preserving those results when intermediaries modify the message. ARC relies on DKIM-style signatures but serves a different purpose.
No. ARC is an independent standard, though it works alongside DMARC by helping receivers understand authentication results that DMARC would otherwise see as failures after forwarding.
Primarily mail intermediaries such as mailing lists, forwarders, and some receiving filters. Individual senders benefit from ARC when their mail passes through those intermediaries, but they do not implement the chain themselves.
No. ARC is additive; it records and seals results without changing the underlying SPF or DKIM checks. Receivers use it to interpret failures in context, not to override genuine authentication results.