What this check looks at
When a message is forwarded, the original SPF almost always breaks (the forwarder's IP isn't in the sender's record), and DKIM breaks too if the forwarder modifies the message. ARC (RFC 8617) lets each forwarding hop record the authentication results it saw and cryptographically seal them, so a later receiver can trust what happened upstream. This check inspects the chain on your message:
- Whether an ARC chain is present at all.
- The chain validation result (
cv=pass,fail, ornone) and how many hops it spans. - The original authentication the first hop recorded (SPF / DKIM / DMARC).
For ordinary direct mail with no chain, ARC isn't applicable and the check stays silent rather than adding noise - it only flags a missing chain when the message was actually forwarded.
Why it matters
Without ARC, forwarded mail that fails DMARC is more likely to be rejected or junked - even though the original message was perfectly authenticated. An intact chain gives ARC-aware receivers a reason to trust the original result and deliver the message anyway.
How the diagnostic grades it
| Result | Severity | What it means |
|---|---|---|
ARC chain is valid (cv=pass) | Pass | An intact chain vouches for the original authentication. |
| Forwarded mail without ARC | Warning | The message was forwarded but carries no chain - ask the forwarder to seal with ARC. |
ARC chain is broken (cv=fail) | Warning | A chain is present but failed validation, so DMARC failures are enforced as usual. |
ARC sealing started here (cv=none) | Info | This is the first hop to seal - there was no prior chain to validate. |
| ARC chain present | Info | A chain exists; its original results are reported for context. |
How to fix it
- If you operate a forwarder or mailing list, enable ARC sealing so downstream receivers can recover the original authentication.
- If your forwarded mail is being junked, ask the intermediary service whether it adds ARC - many still don't.
- JoltMx handles the forwarding fundamentals (re-signing and SRS) so the mail it forwards stays authenticated. See SPF, DKIM & DMARC explained.
Related checks
Message type · DMARC · DKIM · SPF