What is ARC’s role in forwarded mail?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
When email gets forwarded, authentication breaks. The forwarder's IP isn't in the original sender's SPF record. If the forwarder modifies the message, DKIM breaks too. From the receiving server's point of view, a legitimately forwarded email and a spoofed one look identical. ARC's job is to fix that problem.
Authenticated Received Chain (ARC) lets each legitimate intermediary in the forwarding chain leave a signed record of what it saw. When a mailing list or forwarding service passes your email along, it adds ARC headers documenting the authentication state at that point. The final receiving server can check that chain. If the forwarder is trusted, the receiver can honor the original authentication results instead of judging only the broken ones it sees.
ARC doesn't replace DMARC. It works alongside it. DMARC sets the policy. ARC provides the receiver with enough context to apply that policy intelligently when forwarding is involved. Without ARC, strict DMARC enforcement catches legitimate forwarded mail in the same net as spoofed mail. That's the problem ARC was designed to solve.
Both the forwarder and the receiving server need to support ARC. If either side doesn't, the chain doesn't help. If you're seeing DMARC failures on legitimate forwarded mail, our SOS hotline is free and we can help diagnose what's happening.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
