ARC — Authenticated Received Chain

What ARC means

Authenticated Received Chain, specified in RFC 8617 as an experimental protocol, addresses the one thing SPF and DKIM cannot survive: legitimate modification in transit. A mailing list that rewrites a subject line invalidates the DKIM signature, and forwarding changes the connecting address so SPF no longer authorises it — after which DMARC fails for a message nobody forged.

Each intermediary that handles the message adds three header fields sharing an instance number: ARC-Authentication-Results, recording what it saw when the message arrived; ARC-Message-Signature, a signature over the message as it passed through, in the style of DKIM; and ARC-Seal, a signature over the chain so far. The seal carries cv=none on the first hop, cv=pass while the chain remains intact, and cv=fail once it does not. Up to 50 sets may accumulate.

ARC does not override DMARC — it supplies evidence. A receiver that trusts the sealing intermediary may accept a message whose DMARC evaluation failed, because the chain shows the message authenticated before the forwarder touched it. A receiver that has no reason to trust that intermediary is free to ignore the chain entirely, which makes ARC an aid to forwarding rather than a repair for a broken policy.