Agent WranglersSending domain and authentication Optional
Keep authentication through forwarders with ARC
If you run a mailing list or forwarding service, add ARC seals, so receivers can trust results that the forwarding broke.
How to do it
Lists change the subject or footer, which breaks DKIM, and forwarding breaks SPF. ARC (RFC 8617) records the authentication results each hop saw and seals them with a signature. Receivers that trust the forwarder can then honour the original pass. Plain senders do not need ARC.
Example
ARC-Seal: i=1; a=rsa-sha256; d=lists.example.com; s=arc2026; cv=none; b=...How to check
Send a message through your list to a Gmail address. "Show original" contains ARC-Seal, ARC-Message-Signature and ARC-Authentication-Results headers The list's own seal has i=1 and cv=none, and any later seal shows cv=pass.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/arc.