ARC seal
also: ARC, Authenticated Received Chain
ARC (Authenticated Received Chain) is an email authentication method that cryptographically signs the complete chain of custody as a message passes through multiple mail servers, preserving authentication results from previous handlers.
ARC extends email authentication by creating a tamper-evident record of how a message was processed across the mail system. While SPF, DKIM, and DMARC authenticate the original sender, ARC seals intermediate servers' handling of the message, letting receivers trust that nothing was altered in transit.
An ARC seal consists of three main components: an Authentication-Results header (recording prior auth checks), an ARC-Message-Signature (signing the message body and headers), and an ARC-Seal (signing the ARC chain itself with a timestamp). Each mail server that processes the message adds its own ARC seal, creating a chain.
Example: When a mailing list or mail forwarding service receives a message and resends it, ARC allows the final recipient to verify that the intermediate server legitimately processed the original authenticated message, rather than having it appear suspicious due to authentication failure. This is particularly useful for scenarios where DMARC would normally reject forwarded mail.