ARC is an email authentication protocol that lets intermediate mail servers digitally sign a message's authentication results. When a downstream mail server does DMARC verification and finds that SPF or DKIM have failed (due to forwarding or mailing list modifications, for example), it can look for ARC results from a trusted server and use them to decide whether to acept the message.
ARC verification and signing can be enabled at Security|Security Manager|Sender Authentication|ARC Settings. Trusted ARC Sealers are the domains whose ARC results you trust. ARC results from non-trusted domains are ignored when doing DMARC verification. ARC signing needs a selector and a signing domain. You can use the same selector for ARC that you use for DKIM signing, or create a new one. If you host multiple domains and want to use a different selector or signing domain for any of them, click Advanced to configure that. Forwarded messages, mailing list messages, and gateway messages with authentication results are eligible for ARC signing.