ARC-Seal

What Is ARC-Seal?

The ARC-Seal is one of three key headers used in the Authenticated Received Chain (ARC) protocol. It records and cryptographically seals the authentication results added by each mail server that handles a message as it travels toward the recipient.

Essentially, the ARC-Seal acts as a digital signature confirming that the authentication data (SPF, DKIM, and DMARC results) inserted by one server has not been altered by another.

How Does ARC-Seal Work?

When a mail server that supports ARC receives a message, it evaluates the message’s authentication results and then adds three new headers before passing it along:

1. ARC-Authentication-Results – Records the SPF, DKIM, and DMARC results at that hop.
2. ARC-Message-Signature – Signs the content of the message.
3. ARC-Seal – Signs both of the above headers to preserve their integrity.

Each server that forwards the message adds its own ARC set, including a new ARC-Seal. The seals are chained together using sequence numbers (i=1, i=2, etc.), allowing the final receiving server to verify the entire message history and determine whether it has remained trustworthy.

If all seals validate successfully, the recipient can have greater confidence that the message passed through legitimate, authenticated systems even if SPF or DKIM no longer align perfectly after forwarding.

The Role of ARC-Seal in Deliverability

The ARC-Seal helps preserve authentication across complex mail flows, especially those involving forwarding, mailing lists, or ticketing systems.

Without ARC, messages that are modified or re-sent by intermediaries might fail SPF or DKIM checks and be quarantined or rejected. The ARC-Seal ensures that these legitimate messages can still be recognized as authenticated, improving inbox placement and reducing false positives.

For organizations using DMARC enforcement, ARC provides valuable context for deciding whether to trust forwarded messages that would otherwise fail authentication.

ARC-Seal and DMARCeye

DMARCeye helps organizations interpret authentication results that include ARC headers.

By analyzing DMARC aggregate reports and message samples, DMARCeye can show how often authentication fails because of forwarding or intermediary processing, and whether ARC-Seals are being applied correctly.

This visibility helps administrators fine-tune their DMARC policies, maintain strong protection, and ensure legitimate mail continues to reach recipients even in complex delivery paths.