The problem: You own yourname.com for professional credibility, but your actual inbox is a free provider like Gmail. Standard forwarding breaks DMARC alignment, so newsletters, invoices, and client emails get flagged as spam or silently dropped.
How arc-relay helps: Point your domain's MX records to arc-relay. We ARC-seal forwarded messages, recording the SPF, DKIM and DMARC results checked when they arrived (if the newest ARC seal on an arriving message already reports a failed chain, ARC-Relay forwards it without adding its own). Receivers that trust ARC seals, such as Gmail and Outlook, can use those recorded results when the forward itself fails SPF or DMARC. Whether they do, and where they file the message, is their decision.
The problem: Your company operates 10+ brands, each with its own domain. Maintaining separate mailboxes per domain is expensive, fragmented, and hard to manage. Forwarding everything to a central inbox causes DMARC failures across the board.
How arc-relay helps: Point all your domain MX records to arc-relay. Every brand's inbound mail is forwarded to your central inbox, ARC-sealed and SRS-rewritten. The dashboard gives you one-pane visibility across all domains.
The problem: You set up email forwarding for clients, but their newsletters and transactional emails break DKIM/DMARC alignment downstream. The client blames your infrastructure when messages land in spam.
How arc-relay helps: SRS envelope rewriting plus ARC sealing means you can forward client mail without breaking sender reputation. Per-domain logs in the dashboard show what was received, rejected, and handed on for delivery.
The problem: Your organization routes inbound mail through spam filters, DLP, or archival systems. These gateways modify message headers during processing, breaking the original DKIM signatures.
How arc-relay helps: The ARC chain vouches for the original authentication results before the message was modified in transit. Receiving servers that trust ARC seals can use those results instead of the failures the forwarding hop caused; whether they do is their decision.
The problem: You own dozens of domains — legacy brands, typo-squats, future projects. You want to receive email sent to any of them, but provisioning separate mailboxes is wasteful and expensive.
How arc-relay helps: Add each domain in 30 seconds — just point the MX records, no mailbox provisioning needed. Forward everything to a single address. Solo covers 1 domain free; Pro gives 50; Studio is unlimited.
ARC (Authenticated Received Chain) is an email authentication standard (RFC 8617) that preserves authentication results across intermediary hops. When an email is forwarded, the original DKIM signature often breaks because headers get modified in transit.
ARC solves this by having each intermediary server seal the authentication results it observed. Gmail, Microsoft 365, Yahoo, and other major providers check ARC seals when evaluating DMARC — if they trust the sealer, they can use the results it recorded even when the original DKIM signature no longer validates. Whether they do is their decision.
SRS (Sender Rewriting Scheme) rewrites the envelope sender address so the forwarded message comes from arc-relay's domain rather than the original sender's domain. This means the receiving server checks SPF against arc-relay.com, which passes because arc-relay is the actual sending server.
Without SRS, the receiving server would check SPF against the original sender's domain, which would fail because arc-relay's IP isn't authorized for that domain. SRS is invisible to the end user — the displayed "From" address stays the same.
All plans preserve the original DKIM signature. Our ARC seal records, under our signature, whether DKIM verified when the message reached us, and receivers that trust ARC can take that into account.
Pro and Studio plans can optionally enable per-domain DKIM signing. This generates an RSA 2048-bit key for your domain and adds a DKIM-Signature header to every forwarded message. You add one DNS record and it activates automatically.
For most users, ARC sealing alone is enough. Per-domain DKIM is an extra layer for those who want full domain-level authentication on forwarded mail.
Three steps:
10 mx.arc-relay.comDNS changes usually propagate in under 5 minutes. Once verified, all email to your domain is forwarded with full ARC sealing automatically.
All major providers evaluate ARC seals when making DMARC decisions:
Yes. The free Solo plan covers 1 domain and up to 5 aliases, forever — no credit card required. See all plans.
Incoming mail will be temporarily rejected with a retry code, so the sending server holds it in queue. No email is lost — the sender's server will retry. Upgrade your plan or wait for the monthly reset and forwarding resumes automatically.
Reach us at [email protected] — we typically reply within a few hours.
Set up in under 2 minutes. Solo, Pro, and Studio plans.
Get started free →