ProbeKit
Sign inSign up

5.7.29 bounce: ARC validation failure

5.7.29ARC validation failurePermanent: retrying will not help

Typical wording
550 5.7.29 ARC validation failure

What it means

RFC 8617 (Authenticated Received Chain, ARC) registered X.7.29, “ARC validation failure”. ARC lets intermediaries such as mailing lists and forwarders record the authentication results they saw and seal them with a signature, so a later receiver can trust the original SPF, DKIM, and DMARC verdicts even after forwarding broke them.

A 5.7.29 says the ARC set on the message did not validate: a seal or message signature failed, or the chain was incomplete or out of order. Receivers that rely on ARC to rescue forwarded mail then have nothing to fall back on, and may refuse the message.

It concerns the forwarders, not only the original sender. Each hop that adds ARC headers has to sign them correctly, and any later hop that modifies the message without adding its own ARC set can break the chain. A 4.7.29 is possible when a key lookup for a seal failed temporarily.

Likely causes

  • A forwarder or list server whose ARC signing key in DNS is missing or does not match its private key.
  • A hop that modified the message after an ARC set was added and did not add a new set of its own.
  • ARC headers stripped or reordered by a gateway, leaving an incomplete chain (missing instance numbers).
  • An ARC-Seal with cv=fail that a later hop carried forward.

How to fix it

  1. Identify the forwarding hops from the Received and ARC-Seal headers (each ARC set has an i= instance number).
  2. If you run a forwarder or list, check its ARC selector record and signing configuration and send a test through it.
  3. Make sure gateways after the ARC signer do not alter the message or strip ARC headers.
  4. As a sender, sign with aligned DKIM; a valid DKIM signature that survives forwarding reduces how much depends on ARC.

Checks that apply

  • Email Header Analyzer Lays out the ARC-Seal, ARC-Message-Signature and ARC-Authentication-Results sets, showing which instance broke.
  • DKIM Check Looks up the selector record a forwarder uses for ARC signing, since ARC keys are published like DKIM keys.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Do I need ARC as a normal sender?
No. ARC is added by intermediaries such as mailing lists and forwarders. Normal senders need SPF, DKIM, and DMARC.
Who fixes an ARC failure?
Usually the operator of the forwarding hop whose seal or signature failed, which the headers identify.

All 191 bounce codes