I'm new to email authentication and trying to understand what ARC adds to DKIM when a message is forwarded. If someone sends me a raw email file and says it originally came from a company, can I verify both the original message and the forwarding step with certainty?
How does ARC help authenticate a forwarded email?
Asked by
5r!Tessera_603
Answers
DKIM is a digital signature, not encryption. A sending domain signs selected headers and a hash of the body, and a receiver looks up the public key in DNS to check the signature. A pass tells you the signed content verifies under that domain's key. It doesn't by itself prove that the visible From address is trustworthy or that the message reached a particular person.
Forwarding doesn't always break DKIM. It can still pass if the parts covered by the signature survive unchanged. Changes to the body or signed headers can cause it to fail, though, even when the forwarding was legitimate.
Reply to this answer
ARC lets a participating mail system record authentication results it saw and sign that record before passing the message along. Each ARC set has an ARC-Authentication-Results header, an ARC-Message-Signature and an ARC-Seal. The i value identifies the set's position in the chain.
A later receiver can validate the chain and see, for example, that a forwarder reported a DKIM pass before making a change that broke the original signature. But a valid seal only shows that the ARC set was signed by the named sealing domain and hasn't been altered in ways that invalidate the chain. It doesn't guarantee that the reported result was honest or correct. The receiver still has to decide whether to trust that sealer.
5r!Tessera_603:
So the seal is evidence of what a particular system reported, not independent proof that its original check was right?
r61!foldout_9:
Right. Also, not every server adds an ARC set, so the chain isn't necessarily a complete map of the message's journey.
Reply to this answer
For a raw email file, keep the complete headers and body intact. A verifier needs the DKIM-Signature header, the headers it names, the body, and the corresponding public key from DNS. For ARC, it needs all the ARC headers in the chain, the message content needed to check the ARC message signatures, and the sealers' public keys from DNS.
How the file was forwarded matters too. If it's an attachment, the inner file and the outer forwarding email are separate messages. The outer message may have its own authentication results, but those don't automatically authenticate the contents of the attachment. Check each separately and treat claimed results inside the file according to who signed them and whether you trust that signer.
Even a valid original DKIM signature and a valid ARC chain don't prove every delivery step or establish with certainty who received the original. Verification can also be limited if a relevant DNS key is no longer available.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Lasker.4v:
DMARC adds an alignment check between the visible From domain and an authenticated domain. A DKIM pass from some unrelated domain isn't enough on its own.