ARC (Authenticated Received Chain) lets intermediaries like mailing lists and forwarders preserve the original SPF/DKIM/DMARC results when they modify a message. Receivers that trust the ARC chain can honor the original authentication, so legitimate forwarded mail isn’t wrongly rejected by DMARC.
Forwarders and lists often break SPF (new server) and sometimes DKIM (modified body), causing legitimate mail to fail DMARC. ARC records a cryptographically signed chain of the authentication results at each hop.
A receiver that trusts the forwarder’s ARC seal can accept a message that would otherwise fail DMARC, based on the authentication that passed before the message was modified. ARC supports, but does not replace, DMARC.
Check your DMARC record now
Open the free DMARC checker →Mostly it’s handled by mailbox providers and forwarders, not individual senders. The practical takeaway is to rely on aligned DKIM, which survives most forwarding.
