IETF draft calls time on ARC and asks to reclassify RFC 8617 as Historic

On October 21, 2026, J. Trent Adams of Proofpoint and John Levine of Taughannock Networks posted version -01 of "Reclassifying ARC as Historic", a DMARC working group draft. Its abstract calls for ending the experiment defined in RFC 8617, recommends that ARC "no longer be deployed or relied upon between disparate senders and receivers", and asks that the RFC be reclassified as Historic. The working group approved the -00 version in April 2026; this is the first revision since.

What the draft asks

Three conclusions sit at the end of the analysis. The ARC experiment is over and Internet-wide deployment should stop. ARC's lessons should feed into DKIM2. And RFC 8617 should be marked Historic once the working group accepts the draft. The document is still an Internet-Draft, and the Historic request takes effect only on that acceptance.

Why the authors say the experiment failed

ARC was designed to carry authentication results across forwarders and mailing lists, the hops that break SPF and often DKIM and therefore DMARC. The draft's operational findings:

• ARC proved useful mainly inside a single administrative domain. Across the Internet it needed reputation systems for the signers, which were never built at scale. Early adopters used allow lists instead.
• Receivers handled chains with inconsistent policy.
• A valid chain says who handled the message but not what they changed or why. The draft's core lesson: "verifiable history without reputation does not enable safe override of DMARC or other enforcement policies."
• Forwarding breakage stayed the dominant problem, and ARC did not solve it.

Guidance for receivers and operators

Receivers may keep verifying ARC for forensic or intra-domain use, but should not make delivery decisions on chain validity without robust reputation signals. Existing deployments should be decommissioned or limited to controlled, intra-domain contexts. The security section says residual ARC processing should be treated as "diagnostic only", since an attacker could route mail through a permissive intermediary.

DKIM2 is the direction

The draft hands ARC's useful ideas, such as signed handling assertions, to DKIM2, the successor to DKIM under development in the DKIM working group. The same day, that group posted revision -02 of the DKIM2 DNS draft, which now references five algorithms, adding rsa-sha512 and ed25519-sha512, deprecates rsa-sha1 outright, and renames the post-quantum key type to mldsa44-ed25519. Our report on DKIM2 draft -07 covers the core specification.

What senders should do

This section is our analysis. Senders never published ARC themselves, so nothing changes in DNS. What changes is the mental model: the fix for forwarded mail failing DMARC is not coming from ARC, and mailbox providers will keep judging the signature that survives, which is DKIM. Make sure your DKIM signature is aligned with the From domain, since that is also the rule DKIM2 is building in. Verify yours with our DKIM checker.