Email forwarding breaks SPF: how DKIM and ARC help

What it means

Many people forward their mail automatically: an old address to a new one, a university or company alias to Gmail, a contact address to several team members.

When that happens, the email is sent again by the forwarding server. The final receiver checks SPF against that server's IP address, which is not in your SPF record. Result: SPF fails, even though you did everything right.

• DKIM usually survives forwarding: the signature is inside the email and stays valid as long as the content is not changed.
• ARC (Authenticated Received Chain) lets the forwarding server record "this email passed SPF, DKIM and DMARC when it reached me", and sign that statement.

Why it matters

DMARC passes if SPF or DKIM passes and matches your domain. If you rely on SPF only, every forwarded email fails DMARC. With p=quarantine or p=reject, those emails go to spam or are refused, and you never hear about it.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page (/), copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. Check that DKIM passes and is signed by your own domain (d=yourdomain.com), not only by your provider. That is what protects forwarded emails.
• Use the Domain scanner: type your domain at /domain-scanner to check your SPF and DMARC records.

In your DMARC reports, forwarding shows up as sources you do not recognize (university servers, mailbox providers) with SPF failing but DKIM passing.

How to fix it

If you are the sender

1. Sign every email with DKIM for your own domain. Set it up in your mailbox provider and in every tool that sends for you. This is the real fix.
2. Avoid changes after signing. Footers, tracking or disclaimers added by a gateway after the signature can break DKIM. Add them before signing, or sign at the last step.
3. Do not weaken SPF to "fix" it. Adding forwarders' IP addresses or using +all is never the answer.

If you run the forwarding

• Prefer forwarding services that support ARC or SRS (Sender Rewriting Scheme). SRS rewrites the envelope sender to the forwarder's domain so SPF passes there; Gmail, Microsoft 365 and most big providers handle this.
• Instead of forwarding everything, consider collecting mail with an app or IMAP, which does not resend the message.
• Do not forward spam: it hurts the forwarding server's reputation.

Mailing lists

Lists that add a subject tag or a footer break DKIM too. Good list software rewrites the From address (for example "John via List") or adds ARC. You cannot control this from your side, which is one more reason to have aligned DKIM everywhere else.

Check that it is fixed

Send a new test email from the home page and confirm that DKIM passes with your domain. With Delivmail DMARC monitoring in the paid dashboard, forwarded sources should then show DKIM passing even when SPF fails, which is normal and acceptable.