diff --git a/libopenarc/arc.c b/libopenarc/arc.c
index a7599d00..940bc60a 100644
--- a/libopenarc/arc.c
+++ b/libopenarc/arc.c
@@ -3715,7 +3715,7 @@ arc_chain_custody_str(ARC_MESSAGE *msg, u_char *buf, size_t buflen)
 		kvset = msg->arc_sets[set].arcset_ams->hdr_data;
 		str = arc_param_get(kvset, "d");
 		(void) arc_dstring_printf(tmpbuf, "%s%s",
-		                          (set < msg->arc_nsets ? ":" : ""),
+		                          (set < msg->arc_nsets - 1 ? ":" : ""),
 		                          str);
 	}
 
diff --git a/openarc/openarc.c b/openarc/openarc.c
index 8741e64e..8d67a8fb 100644
--- a/openarc/openarc.c
+++ b/openarc/openarc.c
@@ -3851,14 +3851,24 @@ mlfi_eom(SMFICTX *ctx)
 
 		if (ipout != NULL)
 		{
+			_Bool quote = strchr(ipout, ':') != NULL;
+
 			arcf_dstring_printf(afc->mctx_tmpstr,
-			                    " smtp.remote-ip=%s", ipout);
+			                    " smtp.remote-ip=%s%s%s",
+			                    quote ? "\"" : "",
+			                    ipout,
+			                    quote ? "\"" : "");
 		}
 
 		if (conf->conf_finalreceiver && arcchainlen > 0)
 		{
+			_Bool quote = strchr(arcchainbuf, ':') != NULL;
+
 			arcf_dstring_printf(afc->mctx_tmpstr,
-			                    " arc.chain=%s", arcchainbuf);
+			                    " arc.chain=%s%s%s",
+			                    quote ? "\"" : "",
+			                    arcchainbuf,
+			                    quote ? "\"" : "");
 		}
 
 		if (arcf_insheader(ctx, 0, AUTHRESULTSHDR,