Glossary
EMAIL AUTH

ARC

Authenticated Received Chain — a series of DKIM-like signatures that preserve email authentication across mailing-list forwarders that would otherwise break DMARC.

ARC (Authenticated Received Chain, RFC 8617) is a signature chain that preserves the original SPF/DKIM authentication verdict when a message passes through an intermediary — most commonly a mailing list or forwarding service — that would otherwise break DMARC alignment.

The Problem It Solves

Mailing lists modify messages (add [list-name] prefix, footer, remove attachments). That breaks the original DKIM signature. SPF is broken by the list’s own sending IP. Result: the message fails DMARC at the final receiver even though it was authentic at origin.

How ARC Works

Each intermediary adds three headers when it re-emits the message:

  • ARC-Authentication-Results — the SPF/DKIM/DMARC verdict when the message arrived
  • ARC-Message-Signature — a DKIM-style signature over the message body + selected headers
  • ARC-Seal — a signature over all preceding ARC headers, chaining them

The Receiver’s Choice

The final receiver can look at the ARC chain, verify each hop, and decide to accept a DMARC-failing message if the chain traces back to a trusted mailing-list operator (Gmail, Google Groups, Mailman with ARC support).

Current State

Gmail, Outlook, Yahoo, and most large receivers honour ARC. Adoption in self-hosted mailing lists is spotty — Mailman 3.1+ supports it, older versions don’t. ARC does not replace DMARC; it’s a repair mechanism for one specific breakage.

Read what DMARC is, check the DKIM glossary entry, and the SPF glossary entry.

← All terms Learning hub →