Forwarding, mailing lists, and ARC: why legitimate mail sometimes fails DMARC

What breaks and why

When a server forwards a message, it reconnects from its own IP, so SPF for the original domain fails. DKIM usually survives plain forwarding, but mailing lists that add a subject tag or a footer change signed content and break the signature. With both broken, a legitimate message fails DMARC.

• Forwarding: new IP, SPF fails
• Subject tags and footers: DKIM fails
• Both fail: DMARC fails despite a legitimate origin

Authenticated Received Chain

ARC lets each intermediary record the authentication results it saw and seal them with its own signature. A final receiver that trusts the intermediary can use those sealed results when local checks fail. ARC adds three headers per hop: ARC-Authentication-Results, ARC-Message-Signature, and ARC-Seal, numbered with i=.

ARC-Seal: i=1; a=rsa-sha256; cv=none; d=lists.example.net; s=arc1; b=...
ARC-Message-Signature: i=1; a=rsa-sha256; d=lists.example.net; s=arc1; h=from:subject; b=...
ARC-Authentication-Results: i=1; lists.example.net;
  dkim=pass header.d=example.org; spf=pass smtp.mailfrom=example.org; dmarc=pass

Lab: watch authentication change through a list

Join a low-traffic public mailing list or a list you run, send a message from a domain you manage, and save the raw copy you receive back. Compare the Authentication-Results and any ARC headers with a direct message from the same account. Note which checks failed, which intermediary added ARC headers, and whether your mailbox provider still delivered it.

Mitigations

Prefer DKIM alignment, since it survives plain forwarding. List operators can rewrite the From header to the list’s domain or avoid modifying messages. Receivers increasingly honor ARC from reputable intermediaries, which reduces false DMARC failures.