ARC Seal Explainer
Why a perfectly-authenticated email forwarded through a mailing list often fails DMARC at the final hop — and how ARC fixes it.
- You send a perfectly-authenticated email to a mailing list address (e.g.
discuss@list.org). - The mailing list software receives it, then re-sends it to all subscribers — but from the list's own MTA, with a modified Subject (
[Discuss]prefix) and an added footer. - Each subscriber's mailbox provider receives the forwarded mail. SPF fails (your SPF doesn't list the mailing-list MTA). DKIM fails (the body was modified). DMARC therefore fails too.
- With a strict DMARC policy (
p=reject), the message is rejected — even though it's legitimate.
ARC (Authenticated Received Chain, RFC 8617) lets each hop add a sealed assertion of what the auth results were when the hop received the message. The final receiver can chain-verify those assertions back to the original authenticated send.
If you're a sender, you don't need to do anything for ARC — the intermediate hops apply seals. If you're running a mailing list or forwarder, your MTA needs to apply ARC seals; most modern MTAs (Postfix with rspamd, Exim, Gmail's forwarder) do this by default.
Walks through a worked example: original send, forwarded through a list, received at Gmail. Shows the SPF/DKIM/DMARC results at each hop and where ARC saves the message.
When your DMARC reports show forwarded mail failing. When users complain that mail to mailing lists from your domain bounces.
FAQ
Do I need to set ARC up myself?+
If you're a sender: no. ARC is applied by intermediate hops (mailing lists, forwarders). If you're running a mailing list or forwarder, your MTA needs to apply ARC seals — most modern MTAs do this by default.
Keep going
Articles, glossary entries, and other tools on the same topic.
You know the rule. See where you sit against it.
Reference pages tell you the benchmark. Outsolvi tells you whether your team is above or below it — per-rep, per-deal, per-week — and which behavior changes move the number. From $7/user/mo yearly.
See your numberNate built Outsolvi after watching every email-tracking tool he had ever used lie to him about opens. Outsolvi runs Tier 1 to 5 confidence scoring on every open, native in Outlook and Gmail, so the number on the dashboard is one a rep can actually act on.
We update these pages when the underlying mechanics change — new mailbox-provider rules, new tracker behavior, new measurement gaps. The dates above are real revisions, not auto-touches.