I was under the impression this is what Authenticated Received Chain (ARC) was created to solve:
Authenticated Received Chain (ARC) is an email authentication system designed to allow an intermediate mail server like a mailing list or forwarding service to sign an email's original authentication results. This allows a receiving service to validate an email when the email's SPF and DKIM records are rendered invalid by an intermediate server's processing.[1]
ARC is more like a chain of custody than a security feature, unless you are very strict about it (which can cause breakage at scale).
Plus ARC isn't deployed everywhere yet. Large providers tend to do it, but sometimes older established email servers (like in academic institutions) may not be on the cutting edge due to smaller budgets and different use cases.
Comments
I was under the impression this is what Authenticated Received Chain (ARC) was created to solve:
* https://en.wikipedia.org/wiki/Authenticated_Received_Chain
It's how mailing lists are able to keep the original sender's From: header in the messages delivered to members.
ARC is more like a chain of custody than a security feature, unless you are very strict about it (which can cause breakage at scale).
Plus ARC isn't deployed everywhere yet. Large providers tend to do it, but sometimes older established email servers (like in academic institutions) may not be on the cutting edge due to smaller budgets and different use cases.