ARC Authentication

Authenticated Received Chain (ARC) is a standard defined in RFC 8617 that adds a set of headers allowing each mail server in a forwarding chain to cryptographically sign the authentication results it observed. This preserves SPF, DKIM, and DMARC verdicts that would otherwise be invalidated when a message is forwarded or relayed through intermediaries.

Forwarding breaks SPF alignment and can break DKIM signatures, which causes legitimate forwarded mail to fail DMARC checks and get rejected or quarantined. ARC gives receiving servers a trusted audit trail of authentication results so they can apply policy more intelligently instead of penalizing legitimate forwarded messages.

Each handling mail server appends three ARC headers: ARC-Authentication-Results (the auth results it observed), ARC-Message-Signature (a DKIM-style signature over the message at that point), and ARC-Seal (a signature over the accumulated ARC headers). These headers are numbered sequentially per hop, forming a chain. The final receiving server validates each seal in reverse order to verify the chain has not been tampered with, then uses the original authentication results to inform its delivery decision.