ARC chain checker: read the ARC-Seal sets in a message's headers
In short: Paste the full headers of a message that was forwarded or relayed. The tool groups the ARC-Seal, ARC-Message-Signature and ARC-Authentication-Results headers into sets and checks each set against RFC 8617. Limit: It checks the structure of the ARC headers, not the signatures, and makes no DNS lookups.
Paste the message headers and the tool groups every ARC-Seal, ARC-Message-Signature and ARC-Authentication-Results header by its i= instance number, then checks the set: one of each header, instances numbered 1 to N without gaps, cv=none on the first seal and cv=pass after it, no h tag in a seal. It does not verify signatures.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
Two ARC sets, six headers: the first seal says cv=none and the second cv=pass.
- Problems
- 0
- ARC headers
- 6
- Newest seal cv
- pass
What this means for you
That is what RFC 8617 requires; the signatures themselves are not verified.
- One of each header per set
- cv=none, then cv=pass
- No h tag in a seal
- Results at every hop
- ARC
- RFC 8617
- Headers
By SimpleVerifier Team · Last updated · Runs in your browser; nothing you paste is sent to us
A clean ARC chain helps forwarded mail, not a stale list.
- Once your headers look right, clean the list you are about to send to.
- Upload or paste it at /verify. Every address gets a live mailbox check, and the first 100 email checks are free with a Google sign-in, no card.
How do I check an ARC chain?
- Open the received message and copy its full headers (in Gmail, Show original; in Outlook, Message options).
- Paste them in. Folded lines are joined for you.
- Read each set: who sealed it, with which selector, and what cv value the server recorded.
- Fix the sealing server's settings if a set is missing a header, has the wrong cv value or signs a header it should not.
Example
- You enter
- Example headers with two ARC sets: i=1 sealed by mx.example.com with cv=none and i=2 sealed by relay.example.net with cv=pass.
- You get
- Two sets, six ARC headers, no problems. The first seal says cv=none and the second cv=pass, as RFC 8617 requires, and both recorded spf, dkim and dmarc as pass. The signatures themselves are not verified.
- Limits
- Runs in your browser and checks structure only, not signatures.
What is in an ARC set?
RFC 8617 defines three headers that a server adds when it forwards or relays a message: ARC-Authentication-Results (the results it saw), ARC-Message-Signature (a signature over the message) and ARC-Seal (a signature over the earlier ARC headers, carrying the chain status in cv). The three share one instance number, i=1 for the first server, i=2 for the next, up to 50. Together they form a set.
What does cv mean?
The cv tag in each seal is the chain validation status the sealing server recorded: none, pass or fail. RFC 8617 says the first seal must say none and every later seal must say pass, and that no seal in a valid chain may say fail. The tool compares each seal with that rule. It reports what is written; it does not repeat the cryptographic check.
What else does the tool look at?
It flags a seal with an h tag, which RFC 8617 does not allow, and a message signature whose h tag covers ARC headers or Authentication-Results, which the RFC says must be left out. It also lists the authentication results each server recorded (spf, dkim, dmarc), so you can see where a result changed along the path. For the wider picture, the email header analyzer reads the whole message.
Who uses this tool, and for what?
- Deliverability consultants
- Check whether a forwarding service seals messages correctly when a client's mail fails after forwarding.
- Cold email senders
- Read the ARC sets on a test message that passed through a mailing list or a relay.
- Sales ops
- Explain to a colleague why a forwarded message shows different results at each hop.
What can’t this tool tell you?
- It checks the structure of the ARC headers, not the signatures, and makes no DNS lookups.
- It only reads the headers you paste; a missing header may have been cut off when copying.
- Whether a receiver trusts an ARC chain depends on the receiver and is not shown here.
- The tool follows RFC 8617 as written; later updates are not included.
Common questions
- Does the tool verify the ARC signatures?
- No. It reads and checks the structure, which needs no DNS lookup. Checking a signature needs the sealer's public key from DNS.
- Why does my message have no ARC headers?
- ARC headers are added by servers that forward or relay a message. A message sent directly from your own server has none.
- What is the highest instance number?
- RFC 8617 allows instance values from 1 to 50.
- What does cv=fail mean?
- The sealing server found the earlier chain broken when it sealed. RFC 8617 says no seal in a valid chain may say fail.
- Can ARC make a failing message pass DMARC?
- ARC records what a forwarder saw. Whether a receiver trusts that record is up to the receiver; the tool does not predict it.
- Is my header text sent anywhere?
- No. It is read in your browser.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.