Symptoms#
- Messages landing in spam despite previously good placement
- Bounces mentioning policy, authentication, or reputation
- Provider dashboards showing a drop in reputation or authentication pass rate
Diagnosis steps#
- Confirm the configuration is live: query DNS from an external resolver and check the sending platform's settings page.
- Send to a seed mailbox and read the full headers, especially Authentication-Results.
- Compare the domains in From, Return-Path, and DKIM d= for alignment.
- Check provider dashboards (Google Postmaster Tools, Microsoft SNDS) for reputation and error rates.
- Review recent changes: new vendors, DNS edits, list imports, volume spikes.
Likely causes#
- Expecting ARC to fix your own outbound authentication; it only helps intermediaries.
- Trusting ARC from unknown sealers, which reopens the spoofing door.
Fix and re-verify#
- Check whether your inbound gateway or mailing-list software supports ARC sealing.
- Enable ARC sealing on any system that modifies and re-sends mail.
- Verify ARC-Seal, ARC-Message-Signature, and ARC-Authentication-Results headers appear on forwarded mail.
- Confirm downstream receivers (Gmail, Microsoft) honor your seals by checking Authentication-Results for arc=pass.
Frequently asked questions#
Do I need ARC as a sender?
No. ARC is implemented by intermediaries and receivers. Senders benefit indirectly when their mail is forwarded.
Which providers honor ARC?
Gmail, Microsoft, and Yahoo all evaluate ARC when deciding whether to override a DMARC failure.