Why ARC Is Being Retired in 2026 - and What Email Operators Need to Do Before Then

ARC stands for Authenticated Received Chain. It was designed to preserve email authentication results across intermediate hops - particularly useful for mailing lists, forwarders, and third-party aggregators that modify messages in transit.

RFC 8617 was published in 2019. In 2024, the IETF DMARC working group proposed marking it as Historic - a standards-level retirement after seven years of use. The IETF draft that proposes this retirement is draft-ietf-dmarc-arc-to-historic-00.

This is not a bug fix. It is a deliberate call on whether ARC has a future as an active standard.

What it means that ARC is being retired - and when

The retirement is a standards-track action. When an RFC is marked Historic, it means the IETF no longer maintains the specification and participants are free to phase out support for it.

The exact timeline depends on when the IETF formally adopts the draft and how quickly the ecosystem responds. The dmarcdkim.com breakdown notes that this is a draft-stage action - the exact cutoff date is still being discussed in working group sessions.

The practical signal is clear: if you have ARC-dependent infrastructure, you should start planning your migration now. The longer you wait, the fewer ARC headers will be available in the mail stream.

Three things that will break when ARC goes away

1. Reputation systems that rely on ARC headers will lose their input data.

ARC headers carry authentication results from each hop in the chain. If you are using ARC to build a reputation score - for example, to decide whether to accept mail from a forwarded address - you will need a new mechanism once ARC headers stop being added.

2. Forwarding services that depend on ARC will need a fallback.

Some mailing list operators and forwarding services use ARC to preserve authentication context when reshaping messages. When ARC disappears, they need an alternative. The practical options are traditional DMARC alignment checks on the modified message or extended header approaches that are not yet standardized.

3. Aggregate reporting that includes ARC data will have gaps.

If your monitoring tool draws on ARC results as part of its authentication health dashboard, you will see null or degraded data for any message stream that previously relied on ARC. This is not dramatic - it is a quiet visibility loss.

What to use instead of ARC

The most common alternative is to rely on traditional DMARC alignment checks on the final received message. DMARC validates that the From domain aligns with SPF or DKIM results - it does not require ARC headers to function.

If you need to track reputation across forwarding chains, the practical options are:

• Rely on DMARC aggregate reports from your receiving infrastructure
• Use extended header approaches (not yet standardized across receivers)
• Implement custom header signals specific to your forwarding workflow

The working group discussion reflects genuine uncertainty here. Practitioners are asking whether there is a replacement, and the honest answer is: not a direct one. Each operator will need to evaluate their specific use case.

How DMARCFlow helps operators maintain visibility during the transition

DMARCFlow handles both ARC and traditional DMARC authentication. As the ecosystem transitions, operators who depend on ARC for visibility into authentication health need an alternative that does not disappear with the protocol.

DMARCFlow's aggregate reporting dashboard gives operators a stable view of their authentication health that does not depend on intermediate hops adding ARC headers. Aggregate reports are generated by the receiving domain's mail filters, not by the forwarding chain, so they remain available regardless of what happens to ARC.

Action checklist

If you are an email operator using ARC today:

1. Audit every system that reads or writes ARC headers
2. Identify which reputation or forwarding workflows depend on ARC data
3. Plan an alternative approach for each dependency before the retirement date
4. Ask your vendors about their ARC migration timeline
5. Verify that your aggregate reporting still gives you useful data after the transition

FAQ - ARC and DMARC

Is ARC the same as DMARC?

No. DMARC validates that the From domain aligns with SPF or DKIM results. ARC preserves authentication results across message hops when a message is modified in transit. They are related but solve different problems.

Will my existing DMARC setup break when ARC is retired?

Probably not directly. DMARC itself is not being retired. If you are using ARC for forwarding or reputation purposes, you will need to find an alternative approach.

What should I use instead of ARC?

The most common alternative is to rely on traditional DMARC alignment checks on the final received message. If you need to track reputation across forwarding chains, you may need custom header approaches that your receiving infrastructure must explicitly support.

Is this backward compatible?

The retirement is a standards-track action, not a protocol change. Existing ARC headers will still be processed by receivers that support them. The issue is that no new ARC headers will be generated after the retirement date, and the ecosystem may phase out support over time.

How is DMARCFlow positioned during this transition?

DMARCFlow's aggregate reporting dashboard gives operators the visibility they need during this transition - sign up at dmarcflow.com to get started.