Exploring the Authenticated Received Chain (ARC) protocol

Email communication is crucial, yet many legitimate business emails never reach their intended inboxes. Traditional authentication methods often fall short, especially with forwarded messages, causing genuine emails to be flagged as Spam. In fact, advertising emails accounted for 36% of Spam globally last year.

ARC steps in to fill the gaps left by Domain-based Message Authentication, Reporting, and Conformance (DMARC), Sender Policy Framework (SPF), and DomainKeys Identified Mail (DKIM). The protocol works to improve deliverability and credibility while enhancing organizations’ defenses against impersonation attacks like phishing emails, which saw daily volumes reach 3.4 billion in 2023.

ARC boosts both trust and deliverability. It’s essential for any organization that depends on email communication to get familiar with this protocol.

Overview of Authenticated Received Chain (ARC)

What is ARC?

ARC is an email authentication protocol that keeps authentication results intact even after emails are forwarded. It creates a chain of trust, enabling receiving servers to verify an email’s authenticity even after several handoffs.

How does ARC work?

ARC captures the original authentication results (from DMARC, SPF, and DKIM) when an email is forwarded and then adds ARC headers to preserve these results across different servers. This system allows ARC-validated emails to maintain their integrity even after multiple forwarding events.

Why is ARC important?

DMARC, SPF, and DKIM can fail when emails are forwarded because the original authentication headers might change or disappear. The ARC protocol maintains these results, solving the DMARC forwarding issue and helping receiving servers verify an email’s legitimacy. With the average worldwide email open rate reported at 36.11% in 2023, it’s key to ensure your company’s communications are delivered to as many customers as possible.

Why was ARC introduced?

Introduced in 2016 by the Internet Engineering Task Force (IETF) to address a gap in email authentication protocols, ARC has been supported by global email servers such as Google and Microsoft. The protocol’s popularity could be attributed to the fact that 45.6% of emails globally end up in Spam folders as of 2023, and its adoption is expected to keep growing as businesses focus more on email security.

How ARC supports DMARC, SPF, & DKIM

DMARC ensures the ‘From’ address matches the sender’s domain, but this can break during forwarding when the ‘From’ address is changed to that forwarder’s domain. ARC preserves the original DMARC results, reducing the chance of legitimate emails being rejected.

DKIM ensures email integrity with cryptographic signatures, which can be altered during forwarding. ARC captures the original DKIM results, allowing the email to be validated based on its initial authentication.

SPF checks if an email comes from an authorized server but fails if the email is forwarded through an unauthorized server. ARC maintains the original SPF results, aiding in verifying the email’s legitimacy.