Daily Defender News
Aboutmerill.net
Microsoft Defender for Office 365
Email and collaboration

Email Authentication Arc Configure

4 September 2026Doc update+7 / −120 lines

In brief

The page date was updated to 08/03/2026, and vendor-specific ARC sealer mappings, header examples, and PowerShell configuration steps for Proofpoint, Mimecast, Barracuda, Sophos, and IIJ were removed.

What Defender admins need to know

Administrators using this page will no longer find these vendor-specific ARC sealer domains or Set-ArcConfig examples there.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

To add or remove ARC sealers without affecting the other entries, see the examples in Set-ArcConfig.

Vendor-specific ARC sealer configuration

When you add a trusted ARC sealer in Microsoft 365, you enter the domain shown in the d value of the ARC-Seal header. The following table lists the ARC sealer domains for common email security vendors:

VendorARC sealer domain (d= value)Typical selector (s= value)Notes
Proofpointpphosted.comarcselectorUsed by Proofpoint Protection Server (PPS) and Proofpoint Essentials.
Mimecastmimecast.comarc-2018Used by all Mimecast Email Security gateway deployments.
Barracudabarracudanetworks.comarc1Used by Barracuda Email Gateway Defense and Email Security Gateway.
Sophossophos.comarcUsed by Sophos Central Email Security.
IIJsecuremx.jparc20250414Used by IIJ Secure MX Service. Selector values may change over time due to key rotation.

Configure trusted ARC sealers for Proofpoint

Proofpoint Protection Server (PPS) adds ARC headers when messages are processed through the gateway. The ARC-Seal header uses d=pphosted.com.

  1. Verify the ARC sealer domain from a message header: Locate the d= value in the ARC-Seal header to identify the ARC sealer domain. For Proofpoint, look for the following pattern in message headers:

    ARC-Seal: i=1; a=rsa-sha256; d=pphosted.com; s=arcselector;
  t=1657920000; cv=none;
  b=<signature>

  2. Add the trusted ARC sealer in Microsoft 365: Connect to Exchange Online PowerShell and run the following command:

    Set-ArcConfig -Identity Default -ArcTrustedSealers "pphosted.com"

Configure trusted ARC sealers for Mimecast

Mimecast Email Security adds ARC headers when it processes inbound and outbound mail. The ARC-Seal header uses d=mimecast.com.

  1. Verify the ARC sealer domain from a message header: Look for the following pattern in message headers:

    ARC-Seal: i=1; a=rsa-sha256; t=1623745127; cv=none;
  d=mimecast.com; s=arc-2018;
  b=<signature>

  2. Add the trusted ARC sealer in Microsoft 365: Connect to Exchange Online PowerShell and run the following command:

    Set-ArcConfig -Identity Default -ArcTrustedSealers "mimecast.com"

Configure trusted ARC sealers for Barracuda

Barracuda Email Gateway Defense and Email Security Gateway add ARC headers using d=barracudanetworks.com.

  1. Verify the ARC sealer domain from a message header: Locate the d= value in the ARC-Seal header to confirm the Barracuda sealing domain. Look for the following pattern in message headers:

    ARC-Seal: i=1; a=rsa-sha256; d=barracudanetworks.com; s=arc1;
  t=1680000000; cv=none;
  b=<signature>

  2. Add the trusted ARC sealer in Microsoft 365: Connect to Exchange Online PowerShell and run the following command:

    Set-ArcConfig -Identity Default -ArcTrustedSealers "barracudanetworks.com"

Configure trusted ARC sealers for Sophos

Sophos Central Email Security adds ARC headers using d=sophos.com.

  1. Verify the ARC sealer domain from a message header: Locate the d= value in the ARC-Seal header to confirm the Sophos sealing domain. Look for the following pattern in message headers:

    ARC-Seal: i=1; a=rsa-sha256; t=1686324586; cv=none;
  d=sophos.com; s=arc;
  b=<signature>

  2. Add the trusted ARC sealer in Microsoft 365: Connect to Exchange Online PowerShell and run the following command:

    Set-ArcConfig -Identity Default -ArcTrustedSealers "sophos.com"

Configure trusted ARC sealers for IIJ

IIJ Secure MX Service adds ARC headers using d=securemx.jp.

  1. Verify the ARC sealer domain from a message header: Locate the d= value in the ARC-Seal header to confirm the IIJ sealing domain. Look for the following pattern in message headers:

    ARC-Seal: i=1;a=rsa-sha256;d=securemx.jp;s=arc20250414;t=1785207616;cv=none;
b=<signature>

  2. Add the trusted ARC sealer in Microsoft 365: Connect to Exchange Online PowerShell and run the following command:

    Set-ArcConfig -Identity Default -ArcTrustedSealers "securemx.jp"

Configure trusted ARC sealers for multiple vendors

Only add vendors that you actively use and trust. Adding unnecessary ARC sealers increases your attack surface because a compromised vendor could pass spoofed messages through your authentication checks. 

Set-ArcConfig -Identity Default -ArcTrustedSealers "pphosted.Domain1.com","mimecast.Domain2.com","barracudanetworks.Domain3.com","sophos.Domain4.com","securemx.jp"

Find your vendor's ARC sealer domain

If your vendor isn't listed in the vendor ARC sealer domain table, useUse the following steps to identify the correct ARC sealer domain:

  1. Send a test email through the intermediary service to a Microsoft 365 mailbox.
  2. Open the message headers (in Outlook: File > Properties > Internet Headers, or use the Message Header Analyzer). |Mimecast|Enable via Administration > Gateway > Policies > Definitions > ARC Signing.| |Barracuda|ARC is enabled by default in Email Gateway Defense. Verify in Inbound Settings > Anti-Phishing.| |Sophos|Enable in Sophos Central > Email Security > Settings > ARC.| |IIJ|ARC is enabled by default. No configuration is required.|

Explanation: ARC overrides DMARC authentication failures only. It doesn't bypass:

  • Spam filtering (content filtering).
  • Bulk email filtering (BCL threshold).
  • Anti-spam policy actions.
  • Mail flow rule actions. Diagnosis: Review the X-Forefront-Antispam-Report header to determine whether content-based spam filtering caused the message to go to Junk Email independent of ARC:
X-Forefront-Antispam-Report: CIP:10.10.10.10; CTRY:US; LANG:en;
  SFV:SPM; H:mail.fabrikam.com; PTR:mail.fabrikam.com; CAT:SPM;

If any of the values CAT:SPM, CAT:HSPM, or SFV:SPM appear, spam filtering (content filtering) identified the message as spam or high confidence spam, which is independent of ARC.

Resolution: Try the following options to resolve spam filtering: