Email forwarding and DMARC: why SPF breaks along the way
Forwarded mail fails SPF — by design. Why that is, when DKIM saves the day, what mailing lists do differently and when mail is really lost.
Hardly any DMARC report comes without them: entries in which your own mail fails SPF even though everything is set up correctly. The culprit is almost always a forward — the old club address, the university mailbox with a redirect, the colleague who sends everything on to his private account. That is not a mistake in your setup but a quirk of the system that you need to understand once.
Why SPF breaks on forwarding
SPF checks whether the DELIVERING server is allowed to send for the sender domain. With a forward, the forwarding server accepts your mail and sends it on again — now IT is the one delivering, and of course it is not in your SPF. From the final recipient's point of view: SPF fail. That is inherent in the design and affects every domain in the world.
Why DKIM saves the day
The DKIM signature travels INSIDE the mail and survives the forward as long as the content stays unchanged. DMARC needs only ONE passing, aligned check — which is why a properly signed mail still passes after being forwarded: SPF fail, DKIM pass, DMARC pass. That is exactly why DKIM is a mandatory part of the setup before DMARC is tightened.
When mail is really lost
- Your domain has p=reject but NO working DKIM: then every forwarded mail fails completely — the most common real damage.
- The forwarding server modifies the mail (virus scanner footers!): DKIM breaks despite a correct setup.
- The recipient of a forward keeps seeing SPF fails from the same source and at some point classifies it as suspicious.
The practical recommendation that follows: enable DKIM for every sending route, tighten DMARC only once the reports are clean — and read forwarding fails in the reports for what they are: noise, not an alarm. If you forward a lot yourself (say, info addresses to several mailboxes), you are better off distributing server-side within the same mail system instead of via external forwards.
Frequently asked questions
My DMARC reports show an unknown server with SPF fail and DKIM pass — an attack?
No, that is the signature of a forward: an unknown delivering server (SPF fail) but your valid signature (DKIM pass). DMARC passes, everything is fine.
Should I add the forwarding server to my SPF?
No. You never fully know where recipients forward to, and every additional include waters down your list and costs DNS lookups. The right answer to forwarding is DKIM, not a bloated SPF.
What is ARC?
Authenticated Received Chain — a mechanism that lets intermediaries (lists, forwarders) pass on the original check results in signed form. Large providers evaluate it to accept legitimate forwards despite broken checks. As a domain owner you do not need to do anything for it.