In MS365, the configuration can be set and checked as follows:

 

https://security.microsoft.com/authentication

security.microsoft.com > Policies & rules > Thread policies > E-Mail Authentication settings > Trusted ARC Sealers

 

If the corresponding domain was entered via "Edit", make sure that the entry is selected.

 

 

See also https://learn.microsoft.com/de-de/microsoft-365/security/office-365-security/email-authentication-arc-configure?view=o365-worldwide.

 

The following command is available in PowerShell for checking:

Get-ArcConfig

This shows the Trusted ARC Sealer(s).

 

The entry should correspond to the selected key from Mail System > ARC Settings respectively Add / Edit Managed Domain > ARC Settings (see also ARC Sealing - Configuration in the Gateway).