A sealed logbook, traveling with your email.Picture a sealed logbook riding along with your email. Every mail server that touches it adds one entry, and locks that entry with a signature so nobody can forge it. That's ARC. So what is it actually recording, and why does it save your legitimate mail from spam?
⬡ journey-flow, envelope crosses three nodes; a little logbook rides on top, gaining a stamped, locked entry at each hopARC stands for Authenticated Received Chain. It's an authentication protocol that preserves a record of what the original checks, SPF, DKIM, and DMARC, actually found before your message got forwarded or modified.
⬡ title-card, "Authenticated Received Chain", subtitle "keeps a record of what the auth checks saw"Forwarding quietly breaks your auth.Here's why it matters. When email passes through a forwarding service or a mailing list, the original SPF and DKIM signatures often break. The relaying server has a different IP, so SPF fails. The message got tweaked in transit, so DKIM fails. Now the receiver just sees a failed DMARC check, and your perfectly legitimate mail can land in spam.
⬡ auth-flow, message hits a forwarder, SPF flips red, DKIM flips red, DMARC failsARC fixes this by signing the authentication state at each hop. It builds a verifiable chain that says: we saw this message authenticate properly upstream, even though something changed after that. So a downstream receiver can look back and see the mail was real before the forwarder touched it.
⬡ journey-flow, each hop stamps a locked entry; final node reads "authenticated upstream: verified"If the sealed-logbook idea just clicked, subscribe. We're answering every email question, one at a time.
Good news: you don't set up ARC yourself. Your ESP or forwarding service handles the signing. Most modern mailbox providers already respect ARC headers when they arrive.
⬡ record-cards, three cards: "ESP signs" · "forwarder signs" · "receiver reads the chain"⬡ title-cardSo ARC is a sealed chain of custody for your email. It doesn't replace DMARC and it can't promise the inbox, but it gives receivers the evidence they need to trust forwarded mail that would otherwise look broken.
Next up: the exact problem ARC was built to solve, and why forwarding breaks auth in the first place. Subscribe, and I'll see you there.
⬡ end-card, Subscribe + Next: "What problem does ARC solve?" (003.005.002)What is ARC? Authenticated Received Chain is an email authentication protocol that preserves what SPF, DKIM, and DMARC found before a message got forwarded. When mail passes through a mailing list or forwarder, the original signatures often break and DMARC fails on legitimate mail. ARC signs the authentication state at each hop, building a verifiable chain of custody so a receiver can see the message authenticated upstream. You don't configure ARC yourself; your ESP or forwarder handles it, and most modern providers already respect it.
0:00 The sealed logbook
0:20 What ARC stands for
0:40 The forwarding problem
1:20 What ARC does about it
2:10 Who signs it
Next: What problem does ARC solve? → [link 003.005.002]
Full written guide → reviewmyemails.com/emailalmanac/003.005.001
#email #deliverability #authentication