How does ARC fit into this ecosystem?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Your email's DMARC passes at your sending server. Then it lands at Gmail, and Gmail forwards it to a user's alias or mailing list. Suddenly your DKIM breaks. Your SPF breaks. You're failing authentication at the next hop. This is a forwarding nightmare.
That's where ARC steps in.
ARC (Authenticated Received Chain) is a record of custody. When Gmail forwards your email, it doesn't erase the original authentication. Instead, ARC documents "we received this from a trusted sender, authentication passed, and we're now forwarding it." ARC adds new headers that say "I (Gmail) saw this pass authentication, and I'm signing off on that fact."
The receiving mail server can now make a smart choice. Your SPF failed (because Gmail's now the sender). Your DKIM failed (because Gmail modified the message). But ARC says "Gmail vouches for this." If the receiver trusts Gmail, they can deliver to the inbox anyway.
The ecosystem relationship. SPF and DKIM prove you sent it originally. DMARC checks if they align with your From domain. ARC preserves that proof when trusted intermediaries handle it. Authentication alone doesn't guarantee delivery, but ARC helps trusted forwarding survive.
Do you need ARC? If your emails are getting forwarded through Gmail, Yahoo, or similar systems regularly, ARC support helps. But first, make sure your own SPF and DKIM are rock solid. Most forwarding problems get fixed by getting authentication right at the source. Use our free DMARC parser to see where your auth breaks, then reach out to the SOS team if forwarding patterns are stuck.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
