Surgemail has support for ARC signing/sealing and verification.
In general you dont need to use the sign feature but the check feature may have some value, set this setting:
g_arc_check "true"
so surgemail can check Arc headers to validate the chain of custody, however, by default surgemail only trusts the domains listed in arc_white.dat which lists some of the major email domains.
g_arc_sign "true"
Don't expect too much from arc, why? for two reasons, typically surgemail doesn't modify a message in transit, so normally the DKIM header will survive going through a surgemail server so the verification will still work at the destination (unless you are adding footers, which is usually a bad practice). Second ARC only works if the receiving server trusts the Arc sealing server.
Still if your server is modifying messages for some reason then it's worth while, for example mailing lists.