Email authentication

ARC Record Checker

Parse ARC headers from an email to inspect the Authenticated Received Chain: every hop, the ARC sets and the chain validation state. Free, processed in your browser.

Check an ARC chain

Paste the raw email headers. ARC lives in headers, not DNS, so include ARC-Seal, ARC-Message-Signature and ARC-Authentication-Results.

What this ARC checker does

Parses ARC headers from a pasted email
Reconstructs every ARC instance (i=1, 2, …)
Confirms each set has Seal, Message-Signature and Auth-Results
Reports the chain validation state (cv=)
Flags broken or incomplete chains
Processes headers locally — nothing is uploaded

Common use cases

  1. 1Diagnosing why forwarded mail fails authentication
  2. 2Confirming a mailing list preserved authentication
  3. 3Understanding an intermediary's ARC sealing
  4. 4Investigating DMARC failures after forwarding
  5. 5Verifying your own ARC sealer output
  6. 6Learning how the ARC chain is structured

Related tools

Email Header AnalyzerDMARC Record CheckerSPF Record CheckerDKIM Record CheckerEmail Authentication AnalyzerDMARC aggregate report parser

About ARC

ARC (Authenticated Received Chain) preserves email authentication results across intermediaries like mailing lists and forwarders, which often break SPF and DKIM. Each hop adds an ARC set — ARC-Seal, ARC-Message-Signature and ARC-Authentication-Results — tagged with an instance number i=.

The cv= value on the latest ARC-Seal reports the chain state: none at the first hop, pass if intact, or fail if broken. ARC is carried in headers, not DNS, so paste the raw headers to inspect it. It helps receivers give legitimate forwarded mail the benefit of the doubt.

More Free Tools Where This Came From

This utility is one of dozens of free, no-login tools for DNS, email, SEO and developers — all instant and private.

See All ToolsTalk to Our Team

HostCloud.in  ·  Pune, India  ·  Serving 34,987+ Websites Since 2020

FREQUENTLY ASKED QUESTIONS

Got Questions? We Have Answers.

What is ARC?

ARC (Authenticated Received Chain) preserves email authentication results across forwarders and mailing lists that would otherwise break SPF and DKIM.

Is ARC a DNS record?

No. Unlike SPF, DKIM and DMARC, ARC lives in the email headers — ARC-Seal, ARC-Message-Signature and ARC-Authentication-Results — so paste the raw headers here.

What does cv= mean?

cv= is the chain validation state on the latest ARC-Seal: none at the first hop, pass if the chain is intact, or fail if an intermediary broke it.

How do I get the ARC headers?

Open the message in your mail client and choose "Show original" or "View source", then copy the full headers into the tool.

Why did forwarded mail fail DMARC despite ARC?

ARC only lets a receiver trust a prior authentication result; each receiver decides whether to honour it. A broken chain (cv=fail) removes that benefit.

Is my pasted email uploaded?

No. The headers are parsed entirely in your browser and never leave your device.