Simple definition
ARC (Authenticated Received Chain) lets an email intermediary preserve a signed history of authentication results observed before a message is modified or forwarded.
Technical definition
ARC adds a chain of headers including ARC-Authentication-Results, ARC-Message-Signature, and ARC-Seal. Each participating intermediary can add a signed set that represents the authentication state it received and the continuity of the chain.
How it works / role
When a mailing list or gateway receives a message, it records the SPF/DKIM/DMARC results it observed and signs its own ARC set. The final receiver can verify chain integrity and use that history as an additional signal when forwarding has broken the original authentication.
What is it used for?
Help receiving mail systems evaluate legitimate messages that passed through intermediaries which changed the message or delivery path.
Practical example
A mailing list changes the subject and causes DMARC to fail; a valid ARC chain allows the receiver to see the authentication results that were observed before the modification.
Common issues
- ARC chain is invalid or broken
- Intermediary is untrusted even though the signature is technically valid
- ARC is mistaken for a guarantee that the message is legitimate
- Original authentication results were already incorrect
Key takeaway: ARC carries a signed history of authentication results; it provides an additional trust signal but does not by itself guarantee message legitimacy.