ARC

Stands for: Authenticated Received Chain

An experimental email protocol in which each handler of a message records and seals the authentication results it saw.

Forwarders break SPF and lists that edit messages break DKIM, so relayed mail from a p=reject domain can fail DMARC. ARC (RFC 8617, Experimental, 2019) lets each intermediary seal what it saw on arrival, and a receiver may accept that record as local policy. RFC 9989 names ARC as the main attempt to fix this and says none has become widely used.

Each handler adds an ARC Set of three header fields: ARC-Authentication-Results, its assessment on arrival in Authentication-Results syntax; ARC-Message-Signature, a DKIM-like signature that identifies the custodian; and ARC-Seal, which binds the sets into a chain. Instance tags from 1 to 50 order the sets, each holding exactly one of each field, and the chain validation status cv is none, fail or pass.

ARC does not restore a broken SPF or DKIM result; it carries evidence about an earlier one. RFC 8617 lets a DMARC processor accept a chain's assessments as a matter of local policy, and warns that every sealer deserves suspicion, because a malicious actor could seal spam to help it through, and that an intact passing chain can be replayed to many recipients, as with DKIM. Which intermediaries to believe is a policy decision, not a cryptographic one.

RFC 8617 is still Experimental, neither updated nor obsoleted on its RFC Editor page, and it cites RFC 7489, now obsolete. RFC 9989 (May 2026) supports only DKIM and SPF as authentication mechanisms; it records that mailing list software has instead adopted From rewriting, such as the list's own address.

Also known as: arc, authenticated received chain, arc-seal, arc-message-signature, arc-authentication-results

Sources

← All glossary entries