Introduction: SPF errors with email forwarding - what causes them?
In this article, we explain why automatic email forwarding (e.g. from info@ihre-domain.de to ihrname@gmail.com) occasionally leads to delivery issues. We’ll explain the role that SPF, DKIM and DMARC play in email security, why these mechanisms can complicate forwarding - and how SpeedIT mitigates this as effectively as possible using SRS (Sender Rewriting Scheme). By the end, you’ll know which settings make sense and which alternatives can help with stubborn cases.
What are SPF, DKIM and DMARC?
- SPF (Sender Policy Framework): Specifies which servers are authorised to send emails on behalf of your domain. The IP address of the sending server is checked against your domain’s SPF record.
- DKIM (DomainKeys Identified Mail): The sending server cryptographically signs the message. Recipients verify the signature using your public DKIM key in the DNS.
- DMARC (Domain-Based Message Authentication, Reporting & Conformance): A policy in the DNS that specifies what recipients should do if SPF and DKIM do not match. DMARC requires that at least one verification (SPF or DKIM) matches the visible sender domain (alignment).
Objective: To prevent misuse of your domain and improve deliverability.
Why forwarding often causes problems
With a standard forwarding setup, the recipient often no longer sees the original sending server, but the forwarding server instead. This can cause SPF to fail, as the forwarding server is not listed in the SPF record of the original sender’s domain. If, in addition, the DKIM signature is corrupted en route (e.g. due to changes to the content), DKIM will also fail to remain ‘aligned’. With a strict DMARC policy (e.g. p=reject), the recipient may then reject the email.
What SpeedIT does to counter this: SRS (Sender Rewriting Scheme)
SpeedIT applies the SRS method to forwarded emails.
SRS rewrites the technical sender (Envelope-From) so that the recipient can perform the SPF check against the forwarding domain - thereby ensuring the email passes SPF again. This significantly reduces rejections. Important: Even with SRS, recipients such as Gmail make decisions based on several factors (reputation, content, attachments, filters). No one can guarantee 100 per cent delivery.
Your best options for high deliverability
- Avoid forwarding: Retrieve the original mailbox directly in the destination system (e.g. Gmail web interface/IMAP, Outlook, Apple Mail). This ensures that SPF, DKIM and DMARC remain unchanged.
- Enable DKIM everywhere: Ensure that all legitimate senders (online shop, CRM, newsletter tool) use DKIM signing.
- Use DMARC with reporting: Start with p=none and analyse the reports (RUA). Gradually increase to quarantine/reject later.
- Use SRS (already active): Our relay servers use SRS to minimise SPF errors during relaying as much as possible.
Example DNS (for guidance)
SPF (keep it simple, observe lookup limits):
ihre-domain.tld. TXT "v=spf1 mx a include:spf.ws.de-serv.de -all"
DMARC (start gently, tighten later):
_dmarc.ihre-domain.tld. TXT "v=DMARC1; p=none; rua=mailto:dmarc@ihre-domain.tld; fo=1"
(DKIM: Publish the public key at selector._domainkey.your-domain.tld, depending on the system/selector.)
Typical error message (simplified)
“550 5.7.26 Unauthenticated Email - SPF Fail …”
Indicates that the recipient can no longer verify the message’s authenticity after it has been relayed (usually SPF). This is often resolved with SRS; provided DKIM remains valid and aligned, many recipients will accept the message.
FAQ
Does forwarding with SRS always work?
SRS resolves the SPF issue. However, if DKIM becomes corrupted en route or other filters are applied, messages may still be rejected.
Why does it sometimes work and sometimes not?
Recipients weigh up several factors (reputation, content, DKIM validity, rate limits, filters). The cleaner your SPF/DKIM/DMARC are, the more reliable the delivery.
What can I do straight away?
- Replace forwarding with direct retrieval.
- Ensure DKIM is in place on all senders.
- Actively analyse DMARC reports and clean up sources.
If you’re still having issues
Our support team will be happy to analyse your specific case. To do this, please send us the complete email headers of the affected message. This will enable us to identify where the authentication has failed and which measure (SRS, DKIM correction, DMARC fine-tuning) will help.
Conclusion
SPF, DKIM and DMARC form the basis for secure, trustworthy emails. Forwarding can interfere with these checks - particularly SPF.
By using SRS (enabled at SpeedIT), consistent DKIM and - where possible - avoiding forwarding in favour of direct retrieval, you can significantly improve delivery rates.