What happens when ARC chains break?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Your email gets forwarded through a mailing list. The ARC chain should prove it's legit. But then something goes wrong. A seal is invalid, headers got modified, or instance numbers are out of order. The receiver says "nope" and marks it as cv=fail.
Here's what happens next. The receiver ignores the ARC chain completely and falls back to standard SPF, DKIM, and DMARC checks. If DMARC fails for the original sender, you're back where you started. The email gets quarantined or rejected. ARC's whole job was to rescue forwarded mail, so when it breaks, you lose that protection.
Here's the good news. A broken ARC chain isn't worse than no ARC at all. You don't get extra penalties. It's just like the ARC signer never tried to help. But that means if you rely on ARC to get your mailing list emails through, a broken chain will hurt deliverability. Common culprits include intermediaries that don't update their signing keys, or gateways that modify headers after signing. You can spot these with header inspection.
Next step. Check your email headers for ARC records and cv= values. If you're seeing cv=fail on forwarded mail, reach out to your intermediary (mailing list, ESP, relay service) to check their ARC implementation.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
