---
title: "Keep authentication through forwarders · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/arc
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep authentication through forwarders with ARC

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Optional
- Chapter: [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)
- Rule: If you run a mailing list or forwarding service, add ARC seals, so receivers can trust results that the forwarding broke.
- How: Lists change the subject or footer, which breaks DKIM, and forwarding breaks SPF. ARC (RFC 8617, an experimental RFC) records the authentication results each hop saw and seals them with a signature. Receivers that trust the forwarder can then honour the original pass. Gmail's sender rules ask forwarders and lists to add ARC. Plain senders do not need ARC.
- Check: Send a message through your list to a Gmail address. "Show original" contains `ARC-Seal`, `ARC-Message-Signature` and `ARC-Authentication-Results` headers. The list's own seal has `i=1` and `cv=none`, and any later seal shows `cv=pass`.

Example:

```text
ARC-Seal: i=1; a=rsa-sha256; d=lists.example.com; s=arc2026; cv=none; b=...
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/arc`.

- Previous: [Pin mail TLS with DANE](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/smtp-dane)
- Next: [Show your logo with BIMI](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/bimi)
- [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)