Complete setup guide

Documentation

Everything you need to set up ARC-Relay, configure DNS, and start forwarding with full DMARC compliance.

Quick Start

1

Create an account

Sign up free — no credit card required. Takes 15 seconds.

2

Add your domain & set DNS

We give you the exact MX and TXT records. Copy-paste into your registrar.

3

Emails start flowing

All mail to your domain is ARC-sealed and forwarded to your inbox. Done.

Adding a Domain

1
Open the Domains page

Log in to your dashboard and click Domains in the sidebar.

2
Enter your domain name

Type the bare domain (e.g. example.com) and click Add Domain. Don't include www. or http://.

3
Copy the DNS records we provide

You'll see an MX record and a TXT verification record. Add both to your domain's DNS. See DNS Configuration below for details.

4
Click Verify

We'll check your DNS records. Once both MX and TXT are found, your domain status turns to Verified and forwarding begins immediately.

DNS Configuration

Add these records at your domain registrar or DNS host. The exact values are always shown in your dashboard — these are the general templates.

MX Mail Exchange Record

Required
This tells mail servers to deliver your domain's email to ARC-Relay.
Type: MX
Name: @ (or leave blank)
Value: 10 mx.arc-relay.com
TTL: 300 (or Auto)

If you have existing MX records (e.g. from Google Workspace or Microsoft 365), remove them first — you can only have one mail destination. ARC-Relay will forward everything to your real inbox.

TXT Verification Record

Required
Proves you own this domain. The value is unique per domain — copy it from your dashboard.
Type: TXT
Name: @ (or leave blank)
Value: arcrelay-verify=<your-unique-token>
TTL: 300 (or Auto)

TXT SPF Record

Recommended
Authorizes ARC-Relay to send on behalf of your domain. Not strictly required (SRS handles SPF), but improves deliverability.
Type: TXT
Name: @
Value: v=spf1 include:_spf.arc-relay.com ~all

TXT DMARC Policy

Recommended
Tells receiving servers to check SPF/DKIM alignment and report failures. This protects your domain from spoofing.
Type: TXT
Name: _dmarc
Value: v=DMARC1; p=quarantine; rua=mailto:[email protected]

Provider-Specific Guides

Cloudflare

  1. Go to your domain → DNS tab
  2. Delete any existing MX records
  3. Click Add Record → Type: MX
  4. Name: @, Mail server: mx.arc-relay.com, Priority: 10
  5. Add another record → Type: TXT, Name: @, Content: your verification token

DNS propagation: usually instant on Cloudflare.

Namecheap

  1. Go to Domain ListManageAdvanced DNS
  2. Under Mail Settings, choose Custom MX
  3. Add MX record: mx.arc-relay.com priority 10
  4. Under Host Records, add TXT record with Host: @ and your verification token

DNS propagation: 1–5 minutes.

GoDaddy

  1. Go to My ProductsDNS
  2. Remove existing MX records
  3. Click Add → Type: MX, Host: @, Points to: mx.arc-relay.com, Priority: 10
  4. Add TXT record with Host: @, TXT Value: your verification token

DNS propagation: up to 10 minutes.

Other Providers

The process is the same everywhere:

  1. Remove existing MX records
  2. Add MX: 10 mx.arc-relay.com
  3. Add TXT: your verification token

If you're stuck, email [email protected] with a screenshot and we'll help.

Verification

After adding your DNS records, click the Verify button on your domain card. We check for two things:

MX record points to mx.arc-relay.com

We do a DNS lookup for your domain's MX records and confirm ours is present.

TXT record contains your verification token

We look for the unique arcrelay-verify=... string in your domain's TXT records.

DNS changes usually propagate within 1–5 minutes. Some providers (notably GoDaddy) can take up to 30 minutes. If verification fails, wait a few minutes and try again.

How Forwarding Works

When someone sends an email to [email protected], here's what happens:

1. Sender's server looks up your MX record

DNS returns mx.arc-relay.com, so the email is delivered to our server.

2. ARC-Relay authenticates the incoming message

We check SPF, DKIM, and DMARC on the original message and record the results.

3. We add an ARC seal

Three headers are added: ARC-Authentication-Results, ARC-Message-Signature, and ARC-Seal. These cryptographically vouch for the original auth results.

4. DKIM signing Pro+

If enabled, we add a DKIM-Signature header signed with your domain's private key. This gives the forwarded message full domain-level authentication on top of ARC.

5. We rewrite the envelope sender (SRS)

The envelope sender becomes [email protected]. This fixes SPF because the receiving server checks SPF against our domain. The visible "From" header stays unchanged.

6. Delivered to your inbox

Gmail, Outlook, ProtonMail, or Yahoo sees a valid ARC chain + passing SPF — the email lands in your inbox, not spam.

ARC Sealing Explained

ARC (Authenticated Received Chain) is defined in RFC 8617. It solves a fundamental problem: when email is forwarded, the original DKIM signature usually breaks because headers get modified in transit.

ARC works by having each intermediary server in the forwarding chain sign a set of headers that attest to the authentication results it observed before the message was modified. If a downstream receiver trusts the ARC sealer, it can accept the message even though the original DKIM no longer validates.

# Headers added by ARC-Relay:
ARC-Authentication-Results: i=1; arc-relay.com;
  dkim=pass header.d=sender.com; spf=pass; dmarc=pass
ARC-Message-Signature: i=1; a=rsa-sha256; d=arc-relay.com;
  s=arc; h=from:to:subject:date; b=<signature>
ARC-Seal: i=1; a=rsa-sha256; d=arc-relay.com;
  s=arc; cv=none; b=<seal-signature>

Major providers that evaluate ARC seals: Gmail, Microsoft 365, Yahoo Mail, ProtonMail, Fastmail, Zoho.

SRS Rewriting Explained

SRS (Sender Rewriting Scheme) rewrites the envelope sender so that SPF checks pass at the final destination. Without SRS, forwarded email fails SPF because ARC-Relay's IP address isn't listed in the original sender's SPF record.

# Before (original envelope sender):
MAIL FROM: <[email protected]> ← SPF fails (our IP isn't Gmail's)
# After SRS rewrite:
MAIL FROM: <[email protected]> ← SPF passes

The visible From: header in the email is never modified — the recipient still sees the email as coming from the original sender. SRS only affects the invisible envelope sender used for SPF checks and bounce routing.

Per-Domain DKIM Signing Pro+

All plans preserve the original DKIM signature and use ARC sealing to prove it passed at origin. This is usually enough for inbox delivery.

Pro and Business plans can optionally enable per-domain DKIM signing. This adds a DKIM-Signature header signed with your domain's own RSA key, giving the forwarded message full domain-level authentication.

# Headers on a forwarded message (Pro+ with DKIM enabled):
DKIM-Signature: d=yourdomain.com; s=arcdkim; ...
ARC-Seal: d=arc-relay.com; s=arc; ...
ARC-Message-Signature: d=arc-relay.com; ...
ARC-Authentication-Results: arc-relay.com; dkim=pass ...

How to enable:

  1. Go to Domains in your dashboard
  2. Click the DKIM button on a verified domain
  3. Click Generate DKIM Key — we create an RSA 2048-bit keypair
  4. Add the DNS TXT record shown (e.g. arcdkim._domainkey.yourdomain.com)
  5. Click Re-check DNS to verify — DKIM signing activates automatically

Catch-All Forwarding

ARC-Relay operates as a catch-all forwarder by default. This means:

  • [email protected] is forwarded to your inbox
  • No need to create individual mailboxes or aliases
  • Give out support@, sales@, yourname@ — they all arrive in one place

All forwarded mail goes to the email address you signed up with. This is the address shown on your account settings page.

Email Health Score

Get a 0–100 score and letter grade (A+ to F) for any domain's email authentication setup. The health score checks DMARC, SPF, MX, and DKIM records and returns actionable recommendations.

# Free — no API key needed
curl https://arc-relay.com/api/tools/health/example.com
# Bulk check (Pro+ with API key)
curl -X POST https://arc-relay.com/api/tools/health/bulk \
-H "Authorization: Bearer ar_live_..." \
-d '{"domains": ["a.com", "b.com"]}'
Scoring breakdown:
35
DMARC
35
SPF
15
MX
15
DKIM

SVG Badge: Embed a live health badge in your README — https://arc-relay.com/api/tools/health/YOUR-DOMAIN/badge

Try it free on the Email Health Tool page.

API Keys

Generate API keys from the Settings page. Keys use the prefix ar_live_ and are hashed (SHA-256) at rest — we only show the full key once at creation time.

1
Go to Settings → API Keys

Name your key (e.g. "CI pipeline") and click Create.

2
Copy the key immediately

It won't be shown again. Store it in your CI secrets or password manager.

3
Use it in the Authorization header

Authorization: Bearer ar_live_...

Up to 5 keys per account. Monthly API quotas: Free 100, Pro 5,000, Business 50,000, Enterprise unlimited. Track usage in Settings.

DNS Monitoring Pro+

Set up automated monitoring for your domains' DNS records. ARC-Relay periodically checks DMARC, SPF, MX, and DKIM and emails you when something changes or breaks.

1
Go to Domains in your dashboard

Click the Monitor button on any verified domain.

2
Choose your alert email

Defaults to your account email. We'll send alerts here when scores drop.

Pro: checks every 24 hours  |  Business: checks every 6 hours

Alerts include the old vs new score and specific records that changed. Weekly email digests (Monday 9 AM UTC) summarize all your monitored domains.

Webhooks Business+

Get real-time HTTP callbacks when email events occur. Useful for alerting, analytics pipelines, or triggering workflows in external systems.

# Webhook payload (HMAC-SHA256 signed)
POST https://your-app.com/webhook
X-ARC-Relay-Signature: sha256=abc123...
Content-Type: application/json
{
"event": "email.forwarded",
"domain": "example.com",
"timestamp": "2026-03-05T14:30:00Z"
}

Events: email.forwarded, email.bounced, email.blocked

Retries: Failed deliveries are retried up to 3 times with exponential backoff. Endpoints are disabled after repeated failures.

Manage webhooks from Settings → Webhooks in your dashboard. Up to 10 endpoints per account.

Integrations

GitHub Action

Monitor your domain's email health in CI/CD. The action calls the health score API and fails the build if the score drops below your threshold.

# .github/workflows/email-health.yml
name: Email Health Check
on:
schedule:
- cron: '0 9 * * 1'
workflow_dispatch:
jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: rrhoopes3/Arcrelay/integrations/github-action@master
with:
domain: example.com
fail-threshold: 70

Outputs: score, grade, result (full JSON). Supports single domain or bulk checks with an API key.

WordPress Plugin

One-click email health monitoring for WordPress sites. Dashboard widget, settings page with DNS setup guide, and an embeddable shortcode badge.

  • Settings page — health score, DNS records, provider tips
  • Dashboard widget — score at a glance on every login
  • Shortcode[arc-relay-score] embeds a live badge
  • Zero dependencies — single PHP file, cached API calls

Install by uploading the arc-relay-email-auth folder to /wp-content/plugins/ and activating. No API key required for basic health checks.

AI Agent Tools

ARC-Relay includes a built-in MCP (Model Context Protocol) server with 28 tools that AI agents can call directly. Agents can manage domains, check health scores, read logs, configure DNS monitoring, and more.

# Discovery endpoints
GET /llms.txt # Agent capabilities overview
GET /for-agents # Full machine-readable guide
GET /api/openapi.json # OpenAPI 3.0 spec
GET /.well-known/mcp.json # MCP manifest

Any page that serves HTML also supports Accept: text/markdown content negotiation — AI agents get clean markdown instead of HTML.

Troubleshooting

Domain verification fails

  • Wait a few minutes. DNS propagation can take 1–30 minutes depending on your provider.
  • Check for typos. The verification token must be an exact match — copy it directly from the dashboard.
  • Check the record host. Some providers want @, others want the field left blank. Don't enter your full domain name (e.g. don't put example.com in the Name field — that would create example.com.example.com).
  • Verify externally. Use MXToolbox to check if your MX and TXT records are visible.

Emails going to spam

  • Check your domain status. Make sure it shows Verified in the dashboard.
  • Add the SPF record. While ARC + SRS handle authentication, adding our SPF include further improves trust signals.
  • Add a DMARC policy. Even a basic v=DMARC1; p=none record helps.
  • Mark as "Not spam" once. Some providers need a one-time signal that this sender is trusted.

Not receiving any emails

  • Confirm MX records. Run dig MX yourdomain.com or check MXToolbox. You should see mx.arc-relay.com only.
  • Remove conflicting MX records. If you have other MX records with lower priority numbers, mail may go there instead of ARC-Relay.
  • Check your Live Logs. If we received the email, it'll show in your logs with a status.
  • Check your forward limit. If you've hit your monthly limit, forwarding pauses. The sender's server will retry automatically.

"Monthly forward limit reached" rejection

  • No email is lost. We reject with a temporary error code (4xx), so the sender's server holds the message and retries.
  • Upgrade your plan for higher limits, or wait for the monthly reset (1st of each month).
  • Check your usage in the Analytics dashboard.

Plan Limits

Feature Free Pro ($9/mo) Business ($29/mo) Enterprise
Domains 3 50 Unlimited Unlimited
Forwards per month 500 10,000 Unlimited Unlimited
Aliases per domain 5 50 Unlimited Unlimited
ARC sealing + SRS
Per-domain DKIM signing
DNS monitoring 24h checks 6h checks 6h checks
API quota (monthly) 100 5,000 50,000 Unlimited
Log retention 7 days 30 days 90 days 90 days
Webhook notifications
Weekly email digest
Support Community Priority email Dedicated Dedicated + SLA

Limits reset on the 1st of each month. When a limit is hit, we reject with a temporary error — the sender's server retries automatically. No email is lost. See pricing.

Security & Privacy

No email storage

ARC-Relay is a pass-through relay. We process emails in memory, add ARC headers, and forward them immediately. We do not store, read, or index email content.

Encrypted in transit

All connections use TLS (STARTTLS for SMTP, HTTPS for the dashboard). Your emails are encrypted between every hop.

Minimal metadata logging

We log sender address, recipient address, domain, and delivery status for your Live Logs and Analytics. This metadata is tied to your account and not shared with third parties. We do not log email subjects or body content.

Account deletion

You can delete your account from the Settings page at any time. This permanently removes all your data — domains, logs, and account info. This action is irreversible.

Ready to set up your first domain?

Free tier available. No credit card required.

Get Started Free