ARC Sealing

How PerfectMail records what it found when it passes a message along.

When a message is forwarded, or relayed by a mail server on its way to your mailbox, the checks that the final receiver makes can start to fail even though the message is genuine. SPF fails because the forwarding server is not one the original sender listed, and DKIM fails if anything in the signed message was changed along the way. With DMARC in place, a sender’s policy may then tell the receiver to reject a perfectly good message.

ARC (Authenticated Received Chain) is a way for each server that handles a message to record what it found when the message arrived. It does this by adding three headers, called an ARC set: the results that server saw (ARC-Authentication-Results), a signature over the message as it left that server (ARC-Message-Signature), and a seal (ARC-Seal) that signs the earlier ARC sets. Each server adds its own set, so the message carries a numbered chain. A receiver that checks the chain can see that the message was authentic when it first arrived and has not been altered since, even though SPF and DKIM no longer pass at the last step.

Sealing is the process of adding a set. PerfectMail seals with the same DKIM key your domain or server already uses for signing, so DKIM signing must be set up before sealing can work. If a chain arrives that fails its checks, PerfectMail still seals the message, but marks the chain as failed (cv=fail), so that later receivers know. PerfectMail does not seal a message when it cannot decide whether the earlier chain is valid because of a temporary DNS problem, or when an earlier server has already marked the chain as failed.

There are two separate kinds of sealing, and each can be turned on or off for each domain:

• Forwarded e-mail – mail that was sent to one of your users and is then forwarded by their mail server to another address, such as a personal mailbox at another provider.
• Incoming e-mail – mail accepted for one of your hosted domains and relayed on to your protected mail server.

Only mail that did not originate with you is sealed in this way. New outgoing mail from your own users is signed with DKIM, not sealed.

What to expect. A seal is only a statement by your server. A receiver decides for itself whether it trusts the server that made it, and most receivers only trust a short list of well-known sealers. For that reason ARC is not a guarantee that forwarded mail will be accepted. It helps most where the receiver knows and trusts your server, and it does no harm elsewhere. The best protection for forwarded mail is still that it arrives unchanged, which is why PerfectMail does not add a subject tag, a Spam? marking, or a trailer to a message that carries a DKIM signature, and never adds a trailer to forwarded or relayed mail.

A message to which PerfectMail adds a trailer is not sealed, because the added text changes the message body that the seal covers.

PerfectMail has two switches controlling ARC in the DKIM & ARC tab for each domain.

• ARC Seal - This is the default ARC signing mechanism that signs forwarded, outgoing e-mail.
• ARC Seal Incoming - This is an optional ARC signing mechanism to ARC sign incoming e-mail to provide a complete ARC Chain for your Backoffice Mail Server.

See also..

• Sender Policy Framework (SPF)
• DomainKeys Identified Mail (DKIM)
• Domain-based Message Authentication, Reporting, and Conformance (DMARC)
• IP-based Reverse Address Validation (IP-REV)