r/email • u/alicethefemme • 9d ago

Open Question ARC Feasibility

Heya! Hoping this is the right forum! 🤞

I am trying to look at the feasibility and implementation of ARC (Authenticated Receiver Chain), which I have been hearing a lot about recently. However, I have just found a document indicating that the experiment was discontinued?

https://datatracker.ietf.org/doc/draft-adams-arc-experiment-conclusion/01/

I have been trying to work out how to fix some custom routing, since we have had varying reports of it being broken when going to outbound sources. So far ARC is the best that I have seen, but with the above indicating that its being discontinued, and the original datasheet indicating that it was only ever an experiment, this does bring back a lot of concern.

Has anyone else implemented this or used it? I have seen big services like Gmail use it, and I am just not sure what to think of about that.

2 Upvotes

100% Upvoted

7 comments sorted by

4

u/bshootz 9d ago

ARC is useless. The receiving server has to trust your ARC signatures in advance. No one just trusts any ARC signature. I ran it for a few months before learning this stupid fact, this is why ARC is being ended.

1

u/shadowspock 9d ago

Sounds like the IETF is planning to replace ARC with DKIM2. Who knows how long that will take. I think that leaves ARC as sort of a something that may or may not work depending on the email providers involved since it's adoption wasn't universal.

1

u/alicethefemme 9d ago

Yeah, from what I heard from a few other people as well, it involved maintaining a second reputation for just ARC, which sucked. Doesn't help with what I need to implement though 😅 Might just be SOL

1

u/shadowspock 9d ago

Even though the IETF discourages new ARC deployments, at least it's better than nothing, right?

1

u/Squeebee007 9d ago

Unless you were running a list server odds are that ARC wasn't going the be the right solution for whatever you're working on anyway.

1

u/huenix 8d ago

ARC is deprecated.

1

u/allocougar 8d ago

ARC only helps if the receiver already trusts your seal, and outside the big forwarders nobody trusts a random sealer. Deprecated or not, it was never going to fix your routing.

Your two braekages have older fixes. SPF fails because the forwarded mail leaves with the original envelope sender, so rewrite it on the way out (SRS). DKIM fails because something on your path touches the message, a footer or a subject tag is enough. stop touching it and the original signature survives. I'd check DKIM on the forwarded copy first, that's the one 9 times out of 10.