The path of a forwarded message, described as a diagram
Picture three boxes in a row with arrows between them. Box 1 is the original sender: a newsletter from example.com, sent by its platform from IP 198.51.100.7, with envelope from [email protected] and a DKIM signature d=example.com. Box 2 is the forwarder: your domain's forwarding service, which receives mail for [email protected] and passes it on from its own IP, 203.0.113.9. Box 3 is the final inbox, say Gmail.
Under the first arrow, everything passes: 198.51.100.7 is in example.com's SPF record, DKIM verifies, the From domain aligns. Under the second arrow, Gmail checks the IP that connected to it, 203.0.113.9, against the SPF record of the envelope domain, example.com. That IP is not listed. RFC 7208 states the outcome plainly: mediators such as forwarders and mailing lists make SPF fail unless mitigations are used. [1]
What happens next depends on DKIM. If the forwarder did not touch the message, example.com's DKIM signature still verifies, and because d=example.com aligns with the From domain, DMARC passes. RFC 9989 makes the same point: relayed mail often fails SPF, while DKIM signatures generally survive relaying. [2]
| Check at the final inbox | Direct delivery | Forwarded, message unchanged | Forwarded, subject or footer added |
|---|---|---|---|
| SPF for example.com | Pass | Fail or softfail | Fail or softfail |
| DKIM d=example.com | Pass | Pass | Fail: changes break the signature [4] |
| DMARC for example.com | Pass | Pass via aligned DKIM | Fail |
What SRS changes, and what it does not
The Sender Rewriting Scheme rewrites the envelope sender of the forwarded message to an address on the forwarder's own domain. SPF is then checked against the forwarder's record, which does list its IP. Cloudflare Email Routing uses SRS and says this rewriting allows SPF to pass at the destination server; the visible From header is not modified. [5] Google gives the same advice to anyone running a forwarder: change the envelope sender to reference your forwarding domain. [4] RFC 7208 describes the same mitigation under its guidance for mediators, without naming SRS. [1]
The limit: after rewriting, SPF passes for the forwarder's domain, not for example.com. DMARC needs an SPF or DKIM pass on a domain aligned with the From address. [2] So SRS fixes SPF results and bounce handling, but DMARC still rides on the original DKIM signature.
What ARC changes
ARC, defined in RFC 8617, lets each intermediary add a set of three headers recording what it saw: ARC-Authentication-Results, ARC-Message-Signature and ARC-Seal. If the forwarder saw SPF, DKIM and DMARC pass on arrival, the final receiver can read that, even if the forwarder's own changes later broke DKIM. [3]
The catch is trust. RFC 8617 is an Experimental RFC, it does not dictate delivery decisions, and it says receivers should treat every sealer with suspicion. A receiver may use a valid chain in its DMARC decision; it is not required to. [3] ARC therefore helps most with large, well-known intermediaries that receivers already trust, and least with a small forwarder nobody has heard of.
How forwarding services document their handling
| Service | Envelope rewriting | DKIM and ARC | DMARC behaviour and limits |
|---|---|---|---|
| Cloudflare Email Routing | Uses SRS; From header unchanged [5] | Adds two DKIM signatures to forwarded mail: one for email.cloudflare.net and one for the routing domain you configured; the page also says ARC is supported [5] | Rejects mail that fails the sender's DMARC policy; mail must pass SPF or carry valid DKIM; does not forward non-delivery reports [5] |
| Namecheap Free Email Forwarding | Not described in its documentation [6] | Not described in its documentation [6] | Up to 100 forwarders; one catch-all destination; receive only, no sending; cannot be combined with Private Email [6] |
| Gmail as the final inbox | Asks forwarders to rewrite the envelope sender [4] | Asks forwarders not to modify content or DKIM-signed headers [4] | Does not automatically treat forwarded mail that passed earlier as authenticated; runs its own checks [4] |
Setups that keep forwarded mail landing
- If you send mail: sign with DKIM on your own domain on every platform. That is what survives forwarding. RFC 9989 says domains publishing p=reject must not rely on SPF alone and must apply valid DKIM signatures. [2]
- If you run a forwarding address: Google's sender guidelines point regular forwarders to its forwarding best practices. [7] In short, choose a forwarder that rewrites the envelope sender and leaves the message alone. Google lists changing MIME boundaries, the subject, or re-encoding the body as changes that can break DKIM. [4]
- Filter spam before it is forwarded. Google warns that forwarded spam can make future messages from your domain more likely to be marked as spam. [4]
- Ask the forwarder to add X-Forwarded-For or X-Forwarded-To headers, which Google recommends so receivers can tell the message was forwarded. [4]
- For an address you use every day, consider a real mailbox on your domain rather than forwarding to a free inbox; see our guide to Zoho Mail's free custom-domain plan.
- Do not forward with Namecheap free forwarding while also needing Private Email or another mail service on the same domain; Namecheap says the two cannot be combined. [6]
Check a forwarded message in five minutes
- Send a message from an outside account to your forwarding address.
- In the final inbox, open the full headers.
- In Authentication-Results, read spf=, dkim= and dmarc=. Expect SPF to show the forwarder's domain if SRS is used.
- Look for ARC-Seal lines; their presence shows the forwarder adds ARC, and cv= shows the chain status. [3]
- If DKIM fails only on forwarded copies, the forwarder is modifying the message. Turn off subject tags, footers or rewrites.
Questions before you decide
Why does forwarding break SPF but not DKIM?
SPF checks the IP address of the last server that handed over the message, and after forwarding that is the forwarder, which the original sender's SPF record does not list. DKIM is a signature on the message itself, so RFC 9989 notes it generally survives relaying unless the content or signed headers are changed.
Does SRS make forwarded mail pass DMARC?
Not on its own. SRS rewrites the envelope sender to the forwarder's domain so SPF can pass, and Cloudflare says this lets SPF pass at the destination. But DMARC needs the passing domain to align with the From domain, and the forwarder's domain does not. The message still needs an aligned DKIM signature.
Will a receiver reject forwarded mail from a p=reject domain?
It may. Cloudflare Email Routing says it rejects incoming mail that fails the sender domain's DMARC policy. RFC 9989 tells receivers not to reject solely because of p=reject and, without other analysis, to treat such mail as quarantine, but receivers set their own policy.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- RFC 7208: Sender Policy Framework (SPF) Accessed 30 Oct 2026
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC) Accessed 30 Oct 2026
- RFC 8617: The Authenticated Received Chain (ARC) Protocol Accessed 30 Oct 2026
- Gmail Help: Best practices for forwarding email to Gmail Accessed 30 Oct 2026
- Cloudflare Docs: Email Routing postmaster Accessed 30 Oct 2026
- Namecheap Knowledgebase: How to set up Free Email Forwarding Accessed 30 Oct 2026
- Google: Email sender guidelines Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.