The DMARC working group moves to retire ARC

J. Trent Adams of Proofpoint and John Levine posted draft-ietf-dmarc-arc-to-historic-01 to the DMARC working group on October 21. It asks that RFC 8617, the Authenticated Received Chain, be reclassified as Historic. ARC was published as an Experimental RFC in 2019. It let intermediaries such as forwarders and mailing lists sign the authentication results they saw, so a downstream receiver could still accept a message whose DMARC check broke in transit. The draft is now a working group document, replacing Adams’s individual draft “Concluding the ARC Experiment.” Its verdict: “The ARC experiment is over.”

The draft does not fault the signatures. A receiver needed a reputation for each sealer before it could let an ARC chain override DMARC, and no internet-scale reputation system for forwarders emerged in the experiment’s ten years. Receivers fell back on allow lists of trusted intermediaries, which worked between partners and did not scale. They also disagreed on how many hops to honor and how to treat broken chains. ARC recorded who handled a message, not what they changed. The draft cites no adoption figures and names no operators. It discourages new deployments, limits existing use to forensic, diagnostic and intra-domain processing, and points to DKIM2, under development in the DKIM working group, as where ARC’s useful parts should go.

Voice has the same forwarding problem. STIR’s answer is the diversion PASSporT in RFC 8946, which lets a retargeting provider sign that it redirected the call. The ARC draft’s finding is that “verifiable history without reputation does not enable safe override of DMARC or other enforcement policies.” SHAKEN attestation works the same way: the signature identifies the originating provider, and the terminating provider decides what that provider’s attestation is worth.