Glossary · Authentication
ARC lets forwarders and mailing lists record the authentication results they saw, so later receivers can trust mail whose SPF or DKIM broke in transit.
When a mailing list or forwarder passes a message on, SPF fails (the forwarder's server isn't in your SPF) and DKIM can break if the list edits the subject or adds a footer. Under a strict DMARC policy, that legitimate mail would be rejected.
ARC (RFC 8617) adds three headers at each hop: the authentication results the intermediary saw, a signature over the message, and a seal over the chain. A final receiver that trusts the intermediary can use the chain to deliver the message despite the DMARC failure. Senders don't publish anything for ARC; it's applied by the systems in the middle.
Every domain you run in one inbox, from $3 a mailbox. 14 days free, no card.