Forwarded email fails SPF
Forwarding paths break SPF because the forwarder is not authorized.
Problem summary
Forwarding paths break SPF because the forwarder is not authorized.
Symptoms
- Original send passes SPF; forwarded copy fails SPF
- Failures appear mainly on auto-forward / list / gateway paths
- DKIM may still pass if the body/headers were preserved
Possible causes
- Forwarder re-sends from IPs not in the origin SPF
- SRS not used; MAIL FROM still claims the origin domain
- Expecting SPF to survive forwarding (it often will not)
How to diagnose
- Compare Received chains and SPF domains on original vs forwarded copies
- Check whether DKIM survived the forward
- Identify whether the path is user forwarding, list expand, or security gateway
How to fix
- Rely on aligned DKIM + DMARC for paths that forward
- Use SRS-aware forwarding where you control the forwarder
- Do not “authorize the world’s forwarders” in SPF
How to verify
- Forwarded samples show dmarc=pass via DKIM when body is intact
- Origin path still spf=pass without overly broad SPF
Prevention
- Treat DKIM alignment as mandatory for DMARC resilience
- Document forwarding-sensitive flows in the auth design
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts