diff --git a/libopenarc/arc.c b/libopenarc/arc.c
index 1c6c9ded..06155459 100644
--- a/libopenarc/arc.c
+++ b/libopenarc/arc.c
@@ -3070,7 +3070,8 @@ arc_set_cv(ARC_MESSAGE *msg, ARC_CHAIN cv)
 **      domain -- domain name
 **      key -- secret key, printable
 **      keylen -- key length
-**  	ar -- Authentication-Results to be enshrined
+**  	ar -- Authentication-Results to be enshrined. It can be NULL,
+** 	      which means no results.
 **
 **  Return value:
 **  	An ARC_STAT_* constant.
@@ -3213,8 +3214,12 @@ arc_getseal(ARC_MESSAGE *msg, ARC_HDRFIELD **seal, char *authservid,
 	arc_dstring_printf(dstr, "ARC-Authentication-Results:i=%u; %s",
 	                   msg->arc_nsets + 1,
 	                   msg->arc_authservid);
-	if (ar != NULL)
+	if (ar == NULL) {
+		/* no-result per RFC 8601 2.2 */
+		arc_dstring_printf(dstr, "; none");
+	} else {
 		arc_dstring_printf(dstr, "; %s", (char *) ar);
+	}
 
 	status = arc_parse_header_field(msg, arc_dstring_get(dstr),
 	                                arc_dstring_len(dstr), &h);
diff --git a/libopenarc/arc.h b/libopenarc/arc.h
index 34cf0736..902373fd 100644
--- a/libopenarc/arc.h
+++ b/libopenarc/arc.h
@@ -480,7 +480,8 @@ extern void arc_set_cv __P((ARC_MESSAGE *, ARC_CHAIN));
 **  	domain -- domain name
 **  	key -- secret key
 **  	keylen -- key length
-**  	ar -- Authentication-Results to be enshrined
+**  	ar -- Authentication-Results to be enshrined. It can be NULL,
+** 	      which means no results.
 **
 **  Return value:
 **  	An ARC_STAT_* constant.
diff --git a/openarc/openarc.c b/openarc/openarc.c
index 7e191dc1..2b67262c 100644
--- a/openarc/openarc.c
+++ b/openarc/openarc.c
@@ -3768,7 +3768,7 @@ mlfi_eom(SMFICTX *ctx)
 		                     conf->conf_keylen,
 		                     arcf_dstring_len(afc->mctx_tmpstr) > 0
 		                     ? arcf_dstring_get(afc->mctx_tmpstr)
-		                     : NULL);
+		                     : "none");
 		if (status != ARC_STAT_OK)
 		{
 			if (conf->conf_dolog)