DOCS · GETTING STARTED · QUICK START

Forward your first email in three minutes.

arc-relay is a managed email-forwarding service with an AI auto-reply layer. You point your domain's MX records at us, create aliases, and we handle the rest.

Add your domain

In the dashboard, click "+ Domain" and enter the domain you own. We'll generate the DNS records you need to add.

Update DNS

Add the records the dashboard shows when you add the domain: TXT (verification), TXT (SPF) and TXT (DMARC) now, and MX once the domain is verified (step 03). Publish the arcrelay-verify=… value exactly as shown. The dashboard shows this value only in the Add-domain dialog, so copy it before you click Verify & add or close the dialog. If you lose it, delete the domain and add it again to get a new value. If you already have an SPF record, add include:_spf.arc-relay.com to it instead of creating a second one. Changing MX routes all mail for your domain through arc-relay, and mail to a domain that isn't verified yet is refused, so don't switch MX until Verify succeeds. Most registrars apply changes within minutes.

◇DNS

ZONE

; you.dev — DNS zone
@        IN TXT "arcrelay-verify=…"   ; exact value from your dashboard
@        IN TXT "v=spf1 include:_spf.arc-relay.com ~all"
_dmarc   IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
@        IN MX  10 mx.arc-relay.com.   ; after Verify succeeds
; DKIM (Pro/Studio): generate the key in the dashboard first, then
; arcdkim._domainkey IN TXT "v=DKIM1; k=rsa; p=…" with the value it shows

Verify and create your first alias

Click Verify on the domain in your dashboard. Verify checks one record, the arcrelay-verify TXT at your bare domain, at the moment you click — nothing polls in the background, so if it isn't found yet, give DNS a few minutes and click Verify again. Once the domain shows verified, switch MX to 10 mx.arc-relay.com, then create an alias and point it at your real inbox.

Send a test

Email [email protected] from any account. It should land in your real inbox within a couple of seconds, with the original sender preserved.

◇Next steps

◇ 01

Set up AI Auto-Reply

Calibrate the assistant on five sample replies

◇ 02

Add routing rules

Move invoices, alerts, and noise out of your inbox

◇ 03

Connect the API

Provision aliases programmatically

DOCS · GETTING STARTED · CORE CONCEPTS

The pieces, in plain English.

Skim this once and the rest of the docs read faster. Each term below is something the dashboard, your DNS zone, or a log line will mention by name.

◇

Aliases

A receiving address on your domain — [email protected], [email protected], [email protected] — that you map to a real inbox. Create as many as you need. Each one is independent and can be paused, renamed, or deleted without touching the others.

◇

Catch-all

Forwards every address on your domain that isn't already an explicit alias. Useful for one-off signups ([email protected], [email protected]) without pre-creating each one. You can blocklist specific patterns on the rules page if a particular address starts attracting noise.

◇

Reply-from-domain

When you reply through arc-relay, the outgoing message is sent from your domain — not your real inbox. The recipient sees [email protected], the message is DKIM-signed by your domain, and your real address never leaks. Conversations stay on your brand even when you're answering from Gmail.

◇

ARC and SRS

Two pieces of plumbing that keep forwarded mail authenticating at the recipient.

SRS (Sender Rewriting Scheme) rewrites the envelope sender so SPF still passes when we relay. Without it, forwarded mail fails SPF at the recipient and gets dropped or quarantined.

ARC (Authenticated Received Chain) is a signed record of the original SPF/DKIM result before we touched the message. ARC is what tells the recipient that the message was legitimate at the source — even though the IP and Return-Path changed in transit.

◇

DKIM (per-domain)

On Pro and Studio, you can generate a DKIM key for a verified domain in the dashboard (DKIM → Generate DKIM key). From then on we sign the mail we forward for that domain with its private key. The matching public key goes in your DNS as a TXT record at arcdkim._domainkey; the dashboard shows the exact value. That signature is what proves the message really came from a server you authorized — and what survives every hop to the recipient. Each domain you add gets its own key; nothing is shared across customers.

◇

DMARC alignment

Your domain's DMARC record applies to mail whose From: is your domain: mail you send or reply from it. It doesn't apply to the mail we forward to you, which keeps the original sender's From:. For forwarded mail, SRS means SPF is checked against arc-relay.com, and the ARC seal records the SPF, DKIM and DMARC results checked when the message arrived, so receivers that honor ARC can take them into account. If you don't have a DMARC record yet, start with p=none while you confirm signing is healthy, then tighten it.

DOCS · HELP · TROUBLESHOOTING

When something isn't right.

The handful of things that actually go wrong, what each one looks like, and the fix.

Domain stuck on "pending"

Nothing checks in the background: a domain stays pending until you click Verify and the record is found. Verify checks one thing — a TXT record at the apex (@ or your bare domain), not on a subdomain, whose value is exactly the arcrelay-verify=… string the dashboard showed when you added the domain. Fix the record if needed, give DNS a few minutes, and click Verify again. If your registrar's UI asks for a host like arcdkim._domainkey, enter it exactly that way — not arcdkim._domainkey.you.dev; the registrar appends your domain automatically.

Forwarded mail isn't arriving

First check logs. If a message shows delivered, we handed it on; look in spam or a tab folder. If it shows rejected, ARC-Relay refused it; hover the status for the reason (a sender rule, your monthly forward limit, or a paused subscription). If it shows failed, handing it on failed and delivery is retried automatically. If nothing shows up at all, check that the domain shows Verified and that dig MX you.dev returns only 10 mx.arc-relay.com. Mail for a domain that isn't verified is refused before it reaches your logs.

Replies are landing in spam

On Pro and Studio, open domains, click DKIM on the affected domain, and confirm it says "DNS record published". Yellow means no DKIM record was found at arcdkim._domainkey yet. The check only looks for a v=DKIM1 record there and doesn't compare keys, so if you generated a new key, replace the old TXT value with the one the dashboard shows now. Some registrars truncate TXT values at 255 characters and need the value split across multiple quoted strings.

AI Auto-Reply isn't triggering

Auto-Reply only runs on aliases that have it explicitly enabled and a calibrated tone. Check auto-reply and confirm the alias is in the active list. By default we draft only — you have to flip a rule (or "auto-send everything") for replies to leave on their own. If a rule says auto-send and nothing's going out, look for ai-skipped entries in logs; the row includes the reason (low confidence, missing tone calibration, attachment present).

Domain health score dropped

The score reflects your domain’s DNS records (MX, SPF, DKIM, DMARC). Open the domain detail page and we list each failing check with a fix link. Common causes: a missing DMARC record, MX records reverting after a registrar UI change (their default record can come back during an unrelated edit), or a recent spam complaint. Fix the failing check and the score updates within an hour.

Recipient returns "550 5.7.1 policy"

This is the recipient's mail server rejecting, not us. Almost always it's because your domain is in p=reject mode but DKIM isn't aligned, or the recipient demands DMARC and you haven't published one. Add a p=none DMARC record, confirm DKIM is green on the domains page, then re-tighten the policy once you see clean reports for a few days.

◇ STILL STUCK

We answer support directly.

If the fix above didn't resolve it, email [email protected] with the affected domain and a recent log timestamp. We answer most threads inside a few hours.

DOCS · SECURITY · DNS RECORDS

Every DNS record you need.

Copy these into your registrar's DNS zone editor. We'll generate the values for your domain; just swap in the ones shown on the dashboard.

◇

MX (Mail eXchange)

Points your domain's incoming mail to arc-relay. Add one MX record, priority 10, pointing at mx.arc-relay.com, and remove any other MX records. This routes all mail for the domain through arc-relay. Mail to a domain that isn't verified yet is refused, so publish the verification TXT below, click Verify, and switch MX only once the domain shows verified.

Host: @ (or your domain)

@  IN MX  10  mx.arc-relay.com.

◇

TXT (ownership verification)

Required: proves you own the domain, and without it the domain never verifies. The value is unique to your domain — the dashboard shows it when you add the domain. Publish it exactly as shown. The dashboard shows this value only in the Add-domain dialog, so copy it before you click Verify & add or close the dialog. If you lose it, delete the domain and add it again to get a new value. This is the only record the Verify button checks.

Host: @

@  IN TXT  "arcrelay-verify=…"

◇

SPF (Sender Policy Framework)

Tells receivers that arc-relay is authorized to send mail on behalf of your domain. Not strictly required for forwarding (SRS handles SPF on forwarded mail), but recommended. A domain can have only one SPF record: if you already have one, add include:_spf.arc-relay.com to it instead of publishing a second.

Host: @

@  IN TXT  "v=spf1 include:_spf.arc-relay.com ~all"

◇

DKIM (DomainKeys Identified Mail)

Pro and Studio plans. Signs the mail we forward for your domain with your domain's own key; the public key proves to receivers that the messages came from a server you authorized. On a verified domain, click DKIM in the dashboard, then Generate DKIM key. The dashboard then shows the TXT record to publish: host arcdkim._domainkey, value v=DKIM1; k=rsa; p=…. Signing starts as soon as the key is generated, so publish the record right away.

Host: arcdkim._domainkey

arcdkim._domainkey  IN TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

The value shown in the dashboard is the complete public key. If your registrar truncates at 255 characters, split it into multiple quoted strings: "part1" "part2"

◇

DMARC (Domain-based Message Authentication)

Sets a policy for how receivers should treat mail that fails SPF or DKIM. Start with p=none to observe without rejecting.

Host: _dmarc

_dmarc  IN TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

Three policies: p=none (observe only), p=quarantine (flag suspicious), p=reject (hard fail). Once you confirm DKIM and SPF align, move from none to quarantine, then reject.

DOCS · EMAIL API · AUTHENTICATION

API key setup in three steps.

Generate a persistent key from your account and use it in the Authorization header on all API requests.

Go to Settings → API Keys

Log in to your dashboard. Under Settings, choose API Keys. Give the key a name (e.g., "CI pipeline", "mobile app") and click Create.

Copy the key immediately

We only show it once. Copy the full value (starting with ar_live_) and store it in your password manager or CI/CD secrets. Never commit it to version control.

Use it in the Authorization header

Pass the key as a Bearer token on every request:

Authorization: Bearer ar_live_your_key_here

◇ API QUOTAS

Monthly MCP tool-call limits by plan: Solo 100 · Pro 5,000 · Studio 50,000 · custom on request. GET /api/usage (or the get_usage MCP tool) shows this month's count. The count resets on the first of each month (UTC).

DOCS · EMAIL API · ENDPOINTS

REST endpoints for alias management.

Programmatically list, create, and delete aliases on any of your domains.

◇

List aliases

Fetch all aliases for a domain, plus its catch-all. :id is the domain's id from GET /api/domains.

GET https://arc-relay.com/api/domains/:id/aliases
Authorization: Bearer ar_live_...

# Response (200 OK)
{"aliases": [{"id": "…", "alias": "hello", "forward_to": "[email protected]", …}], "catchall_forward_to": null}

◇

Create an alias

Add a new forwarding address on a verified domain. alias is the part before the @.

POST https://arc-relay.com/api/domains/:id/aliases
Authorization: Bearer ar_live_...
Content-Type: application/json

{"alias": "billing", "forward_to": "[email protected]"}

# Response (200 OK)
{"alias": {"id": "…", "alias": "billing", "forward_to": "[email protected]", …}}

◇

Delete an alias

Permanently remove a forwarding address. This cannot be undone. :id is the alias's id.

DELETE https://arc-relay.com/api/aliases/:id
Authorization: Bearer ar_live_...

# Response (200 OK)
{"success": true}

◇ RATE LIMITS

The public check endpoints allow 30 lookups a minute per client IP; domain verification and DNS-health checks share 100 requests per 15 minutes per client IP; the MCP endpoint allows 60 calls a minute. Exceeding a limit returns 429 Too Many Requests.

DOCS · EMAIL API · WEBHOOKS

Real-time callbacks for email events.

Get HTTP POST requests when mail is forwarded, rejected (including by a block rule), or fails, and when DNS monitoring sees a change. A Studio plan feature. Useful for alerting, logging, and workflow triggers.

Create a webhook endpoint

Open Webhooks in the dashboard and add the HTTPS URL where you want to receive callbacks (e.g., https://your-app.com/webhooks/arc-relay), or a Slack, Discord, or Telegram destination. You can register up to 5 endpoints per account.

Webhook events

We send events as soon as they happen: forward.success (delivered), forward.rejected (rejected, including by a block rule), forward.failed (relay error), and the DNS monitoring events dns.dmarc_changed, dns.spf_changed, dns.mx_changed, dns.issue_detected. Subscribe to * for all of them.

Payload signature

Every webhook to your own URL is signed with HMAC-SHA256. Verify the signature by computing the hex HMAC-SHA256 of the raw request body with your endpoint's secret and comparing it to the header (the event name is also in X-ArcRelay-Event):

X-ArcRelay-Signature: 3f9a0c…e71b

{"event": "forward.success", "timestamp": "2026-05-01T14:23:45.000Z", "data": {"domain": "you.dev", "sender": "[email protected]", "recipient": "[email protected]", "status": "delivered", "reason": null, "latency_ms": 412}}

Your endpoint's secret is shown once, when you create it. Reject unsigned or mismatched webhooks.

◇ RETRIES

Each event is sent once, with a 10-second timeout. Failed deliveries are not retried, redirects are not followed, and the endpoint stays enabled.

DOCS · INTEGRATIONS

Connect your workflow.

Use webhooks or the API to tie arc-relay into your existing toolchain.

◇

GitHub Actions

Use the API to provision project-specific email aliases in your CI/CD pipeline. Store your API key and the domain's id in GitHub Secrets.

- name: Create project alias
  run: |
    curl -X POST https://arc-relay.com/api/domains/${{ secrets.ARC_RELAY_DOMAIN_ID }}/aliases \
      -H "Authorization: Bearer ${{ secrets.ARC_RELAY_API_KEY }}" \
      -H "Content-Type: application/json" \
      -d '{"alias":"proj-${{ github.run_id }}","forward_to":"[email protected]"}'

◇

Webhook alerting

Post webhook events to Slack, PagerDuty, or a custom alert system. Example Node.js receiver:

app.post('/webhooks/arc-relay', (req, res) => {
  if (req.body.event === 'forward.failed') {
    slack.send(`⚠️ ${req.body.data.sender} → ${req.body.data.recipient} failed: ${req.body.data.reason}`);
  }
  res.sendStatus(200);
});

◇

Audit & logging

Use webhooks to log every mail event to your application database, data warehouse, or log aggregator. Each mail event carries its domain, sender, recipient, status, reason, and timestamp.