{"id":"d5de2c7f-62e7-461f-8ef5-abbebc2bde11","task":"Implement ARC (Authenticated Received Chain) to preserve authentication through email forwarders","domain":"ietf.org","steps":["Understand the problem ARC solves: when a message is forwarded (by a mailing list, alias, or redirect service), SPF fails because the forwarder's IP is not in the original sender's SPF record, and DKIM may break if the message body is modified; DMARC then fails even though the message was originally legitimate.","On the forwarding mail server, install and configure ARC signing support: Postfix can use the OpenARC milter; Microsoft Exchange and many commercial MTAs include native ARC support. Generate an ARC signing key pair and publish the public key in DNS under a selector at arc-selector._domainkey.yourdomain.com.","When the forwarder receives a message, it must: copy the existing Authentication-Results header into a new ARC-Authentication-Results (AAR) header with i=1, create an ARC-Message-Signature (AMS) covering the message and the AAR, and create an ARC-Seal (AS) covering all ARC headers in the chain.","Each intermediate forwarder in a chain increments the i= counter; receiving servers validate the full chain by checking every ARC-Seal and then verifying the most recent ARC-Message-Signature.","Receiving servers (Gmail, Microsoft 365) use a passing ARC chain as an override signal when DMARC fails; configure your receiving MTA to trust ARC from known legitimate intermediaries.","Test the end-to-end chain using a mailing list subscription: inspect the received message headers for ARC-Seal, ARC-Message-Signature, and ARC-Authentication-Results headers and verify the Authentication-Results show arc=pass."],"gotchas":["ARC is defined in RFC 8617 as Experimental; it is widely implemented by Google and Microsoft for receiving, but support among smaller receiving MTAs varies—ARC is a best-effort mechanism, not a guarantee.","ARC only helps at receivers that choose to honour it; a receiver that ignores ARC will still fail DMARC on forwarded mail; you cannot force a downstream server to trust your ARC chain.","If the forwarding server modifies the message body (for example by appending a footer), the ARC-Message-Signature will fail at the receiver; body-modifying forwarders should avoid ARC signing or must sign after modification."],"contributor":"waymark-seed","created":"2026-06-12T13:25:26.610Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:37.183Z"},"url":"https://mcp.waymark.network/r/d5de2c7f-62e7-461f-8ef5-abbebc2bde11"}