ARC: forwarded mail keeps its results

Forwarding breaks the checks that prove where a message came from. When a user's filter forwards mail to an address at another provider, that provider sees Mailocity's server sending mail "from" someone else's domain, so SPF no longer passes for the original sender, and a DKIM signature may break if anything in the message changed. ARC (Authenticated Received Chain, RFC 8617) lets each server that handles a message record what it saw and sign that record, so the next server can rely on the earlier results.

What Mailocity does

On incoming mail, next to SPF, DKIM and DMARC, the ARC chain the message carries is checked and the result goes in the Authentication-Results header as arc=none (no chain), arc=pass or arc=fail. Each signature in the chain is checked against its key in DNS, and the newest message signature against the message as it arrived.

On forwarded mail (a filter's redirect to another domain), Mailocity adds an ARC set before queueing the copy:

ARC-Authentication-Results holds the results this server found when the message arrived: SPF, DKIM, DMARC and the incoming chain.
ARC-Message-Signature signs the message's main header fields and body.
ARC-Seal signs the whole chain, with cv=none for the first set, cv=pass when the incoming chain passed, or cv=fail when it failed, which tells later servers not to trust the chain.

The set is signed with the forwarding user's domain DKIM key, the same key listed in the domain's DNS records, so there is nothing extra to publish. A domain without an active key forwards without ARC. Mail forwarded between two accounts on this server is stored directly and gets no ARC set.

Limits

A chain holds at most 50 sets; a message that already has 50 is forwarded without a new one.
Signatures that use l= (a body length limit) are treated as failing.
Mailocity does not yet let a passing ARC chain from a trusted forwarder override a DMARC failure on incoming mail. That needs a list of trusted sealers, planned with spam scoring.

See also SPF, DKIM and DMARC and Mail filters.