Why email forwarding breaks SPF and DMARC
Forwarding looks simple: mail arrives at one address and gets passed to another. But the second server sees the forwarder sending mail "from" someone else's domain, and authentication can fail.
SPF checks the server that hands over the message. After forwarding, that's the forwarder, which isn't in the original sender's SPF record, so SPF fails. DMARC still passes if the original DKIM signature survives, which it does when the forwarder doesn't change the message. Mailing lists that edit the subject or add footers break DKIM too, and then DMARC fails. Forwarders fix this with SRS and ARC.
What goes wrong, step by step
- Alex at example.com emails [email protected].
- school.edu forwards everything to [email protected].
- Gmail sees the message arriving from school.edu's server, but the envelope sender is still example.com.
- example.com's SPF record doesn't list school.edu's server, so SPF fails.
- If the message is unchanged, Alex's DKIM signature is still valid, so DMARC passes through DKIM and the mail is delivered.
- If school.edu added a footer or changed the subject, DKIM breaks as well, DMARC fails, and Gmail may reject it with 550 5.7.26.
The fixes forwarders use
| Fix | What it does |
|---|---|
| SRS (Sender Rewriting Scheme) | The forwarder rewrites the envelope sender to its own domain, so SPF passes for the forwarder. Doesn't help DMARC, because the From domain is unchanged. |
| ARC (Authenticated Received Chain) | The forwarder records the SPF, DKIM and DMARC results it saw and signs them. Gmail and Microsoft can trust those earlier results from forwarders they consider reliable. |
| From rewriting | Mailing lists change the From to the list's own address ("Alex via Team List"). Ugly but reliable. |
What senders should do
- Always sign with DKIM. It survives plain forwarding where SPF can't. Check yours with the DKIM checker.
- Don't jump straight to
p=reject. Read DMARC reports first to see how much of your mail is forwarded. - Use relaxed DKIM alignment (the default) unless you have a reason not to.
What people who forward should do
- Use your provider's built-in forwarding rather than a script that re-sends mail; big providers add SRS and ARC.
- Instead of forwarding, have the destination fetch the mail (for example, by adding the account to your mail app with IMAP).
- Microsoft 365 blocks automatic forwarding to outside addresses by default; that bounce is 550 5.7.520.
Questions people ask
- Does forwarding always break DMARC?
- No. Plain forwarding breaks SPF but usually leaves DKIM intact, so DMARC still passes. It fails when the forwarder changes the message or the sender doesn't use DKIM.
- What is ARC in email?
- Authenticated Received Chain: a set of headers a forwarder adds to record the authentication results it saw before passing the message on, signed so the next server can trust them.
- Why do forwarded emails go to spam?
- Usually because SPF fails after forwarding and DKIM was broken or missing, so the receiver can't confirm who really sent it.
Sending one email to a whole list? Check the addresses first with Veml, which removes bad and risky emails before you hit send. (Veml and EmailNa have the same owner.)