How do email forwarding and DMARC policies affect email delivery and reporting?
Updated on 21 Jul 2026: We updated this guide for RFC 9989, including the new t=y testing mode and clearer forwarding guidance.
Email forwarding affects DMARC in two separate ways: it changes which server the final mailbox sees, and it can break the authentication evidence DMARC depends on. That is why a Yahoo, Gmail, Outlook, or other receiver aggregate report can show unfamiliar customer domains, vanity-domain forwarders, mailbox providers, or intermediate mail servers even when your original sending setup has not changed.
The direct answer is this: forwarded mail often appears in DMARC reports under the IP address that handed the message to the final receiver, not always under your original sending IP. A p=none policy expresses no handling preference and should not change existing processing, while aggregate reporting continues when an rua address is configured. A p=quarantine policy marks DMARC-failing mail as suspicious. A p=reject policy states that the domain use is invalid, but the receiver still applies local analysis. A failing forwarded copy can therefore be filtered or rejected, and the receiver can record a local-policy override.
Treat forwarded rows in DMARC reports as evidence to classify, not as automatic proof of a sending problem. The key question is whether the reporting IP belongs to your own infrastructure or to a forwarder. If it is your IP and DMARC fails, fix the SPF or DKIM path that should match the visible From domain. If it is a forwarder, the report often shows a normal side effect of mail being relayed after delivery.
What forwarding changes
Forwarding adds another SMTP hop after the message has already left your platform. The final receiver does not only see your original send. It sees the server that last delivered the forwarded copy. That difference matters because SPF checks the envelope sender domain against the IP address that connected to the receiver.
SPF commonly fails after simple forwarding when the relay preserves the original MAIL FROM address, because the relay IP is not authorized by that domain's SPF record. If the relay uses Sender Rewriting Scheme (SRS), SPF can pass for the rewritten forwarder domain, but that result usually does not satisfy DMARC because the domain differs from the visible From domain. DKIM survives forwarding when the message body and signed headers stay intact, but it fails when the forwarder rewrites the subject, appends a footer, modifies MIME boundaries, or changes a signed header. DMARC passes when either SPF or DKIM passes and the passing domain has the required identifier alignment with the visible From domain.
A forwarding path where the final mailbox reports the forwarder in DMARC data.
- SPF result and alignment: Ordinary forwarding often fails SPF. SRS can produce an SPF pass for the relay domain, but that domain usually differs from the visible From domain.
- DKIM survival: DKIM keeps working when the signed message content stays unchanged and the d= domain has the required identifier alignment with the visible From domain.
- Report identity: The aggregate report row names the connecting IP observed by the report generator, so forwarders appear as sources.
- Normal forwarding patterns: Customer domains, vanity domains, mailbox relays, and mailing lists can all appear when real recipients redirect mail.
For a deeper look at the authentication mechanics, the sibling explainer on forwarding breaks authentication covers SPF, DKIM, and DMARC checks in the relay path.
How policy changes delivery
The DMARC policy does not change whether forwarding breaks authentication. It states the domain owner's position after DMARC fails. The receiving mailbox uses that position with local reputation, content checks, and evidence such as a valid ARC chain. Policy is an important input, but it is not the receiver's only basis for delivery.
|
|
|
|
|---|---|---|---|
none | No preference | Existing processing continues | Low |
quarantine | Failure is suspicious | Treat as suspicious | Medium |
reject | Domain use is invalid | Reject after local analysis | High |
How common DMARC policies affect forwarded mail that fails DMARC.
Do not move straight to p=reject just because your own sending systems look clean. Forwarded copies, mailing lists, customer aliases, and legacy senders can create real DMARC failures that only show up once aggregate reports are reviewed.
At p=none, DMARC asks for no change to existing mail processing. The receiver can still use authentication results in its normal filters. Aggregate data shows which mail authenticates, which mail fails, and which sources need investigation before enforcement.
Monitoring-stage DMARC recordDNS
v=DMARC1; p=none; rua=mailto:dmarc-aggregate@example.com; adkim=r; aspf=r
When the policy moves to quarantine or reject, a forwarded copy still passes DMARC if an intact DKIM signature has the required identifier alignment with the visible From domain. When both DMARC authentication paths fail, quarantine marks the message as suspicious and reject states that the use of the domain is invalid. The receiver can override either position when local evidence supports a different outcome.
What RFC 9989 changes
RFC 9989 is the current DMARC standard. It removed the pct tag because receivers did not apply intermediate percentages consistently. Records such as pct=25 are therefore obsolete and should not be used for policy staging.
RFC 9989 quarantine test recordDNS
v=DMARC1; p=quarantine; t=y; rua=mailto:dmarc@example.com
The new t=y tag requests policy testing one level below the published policy. With p=quarantine; t=y, receivers are asked to apply none to failures. With p=reject; t=y, they are asked to apply quarantine. Aggregate reports continue in either case when an rua address is configured, which makes forwarded-mail patterns visible during testing.
Keep p=none until legitimate sources are clean. A receiver that follows the older specification ignores the unknown t tag and can apply the published quarantine or reject policy. Treat t=y as a standards-based testing signal, not as the only protection against delivery impact during the transition.
RFC 9990 defines source_ip in an aggregate report as the connecting IP. For a forwarded copy, that is the relay that connected to the report-generating receiver, not necessarily the system that originated the message.
How to read forwarded sources
The fastest way to avoid false alarms is to separate rows by ownership: your sending IPs, authorized third-party senders, unknown sources, and recipient-side relays. Suped's DMARC monitoring workflow groups source evidence and authentication results so owned failures can be fixed before forwarding patterns influence a policy decision.
DMARC records drawer showing filters, record rows, authentication results, and CSV export
If a failing row is your own IP, treat it as a sending defect. Your system is handing mail directly to the receiver and the receiver is saying the message did not pass DMARC. That usually means neither the SPF-authenticated domain nor a valid DKIM signing domain has the required identifier alignment with the visible From domain, or one of the required records is missing or malformed.
If a failing row is not your IP, classify it before assuming it is forwarding. Check reverse DNS, the reported header From domain, DKIM results, SRS-style envelope rewriting, ARC or local-policy evidence, volume, and recurrence across receivers. Low volume can support a forwarding diagnosis, but some mailing lists and centralized relays produce large forwarded volumes. The interpret DMARC reports guide goes deeper into sender identification and failure types.
Your source
- Action: Fix SPF, DKIM, or same-domain sending before increasing policy.
- Signal: The reported IP is in your sending estate or a service you use.
- Risk: Enforcement blocks real mail because your own authentication is incomplete.
Forwarded source
- Action: Check DKIM survival, SRS or ARC evidence, volume, and recurrence before tightening policy.
- Signal: The connecting IP belongs to a recipient domain, alias service, mailbox relay, or mailing list.
- Risk: Some forwarded copies fail once the policy moves beyond monitoring.
A public DMARC checker is useful when you need to confirm the DNS record that receivers are reading. For broader checks across DMARC, SPF, and DKIM, use a domain health checker before changing policy.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
Why your own IP matters
One practical rule saves time: if the failing IP in the DMARC report is yours, assume authentication is not correct for that message stream. Forwarding failures normally show the IP of the forwarder or intermediate mail server, because that is the system that delivered the copy to the final receiver.
Different RFC5321.MailFrom and RFC5322.From domains are not automatically a filtering problem. They become a DMARC problem when neither SPF nor DKIM passes with the required identifier alignment to the visible From domain.
The visible From address is the domain the user sees. The envelope sender is the return-path domain used during SMTP. DKIM has its own signing domain in the d= tag. DMARC does not require all of these domains to be identical, but it requires at least one passing authentication method to have the required identifier alignment with the visible From domain.
Full quarantine record after testingDNS
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
Fix owned rows before spending much time on forwarded rows. Owned rows are controllable. Forwarded rows are only partly controllable, and the practical mitigation is broad DKIM coverage plus a policy rollout based on report evidence and legitimate-mail impact.
A safe rollout path
Treat p=none as a measurement phase, not as a finished state. Collect aggregate data long enough to identify legitimate senders and indirect mail flows. Then use the RFC 9989 testing flag and complete policy states instead of percentage-based enforcement.
Policy rollout stages
Use source classification and forwarded-mail impact before increasing enforcement.
Monitoring
p=none
Collect reports and classify every legitimate source.
Quarantine test
p=quarantine; t=y
Request one-level-lower handling while reports continue.
Quarantine
p=quarantine
Remove test mode after checking legitimate delivery.
Reject
p=reject
Publish after owned mail is clean and indirect-flow risk is accepted.
Suped's platform turns aggregate reports into source groups, issue alerts, and fix steps. For forwarding work, Suped can separate recipient-side relay patterns from owned sending failures, then keep the report evidence beside each policy change.
- Start: Publish p=none and collect reports for every domain that sends mail.
- Group: Separate owned infrastructure, authorized senders, recipient-side relays, and unknown traffic.
- Test: Publish p=quarantine; t=y and review forwarding patterns while receivers are asked to apply none.
- Enforce: Remove t=y for full quarantine, monitor legitimate delivery, and move to reject when the remaining risk is understood.
If DNS access is slow or spread across teams, Hosted DMARC helps apply policy changes without repeated manual TXT edits. That is useful when test mode needs to be removed after report review.
A good result has owned sources authenticating correctly, authorized senders classified, forwarding volume measured, and policy high enough to stop domain spoofing without blocking important legitimate mail.
What to do with forwarded failures
Forwarded failures need a different response than a broken sender. You cannot add every recipient forwarder to your SPF record, and doing so would be wrong because those relays do not send mail on your behalf. Make outgoing mail resilient enough that DKIM survives ordinary forwarding, then use reports to judge whether the remaining failures are acceptable before enforcement.
- Sign broadly: Apply DKIM to newsletters, transactional mail, support mail, and every authorized stream using your From domain.
- Understand signature limits: Relaxed canonicalization can tolerate limited formatting changes, but it does not preserve DKIM across added footers, subject tags, or substantive MIME rewrites.
- Measure volume: A small forwarded failure rate can be normal, while a failing owned sender still needs correction.
- Interpret ARC carefully: Authenticated Received Chain gives a receiver signed evidence about authentication before forwarding changed the message.
ARC does not turn a DMARC failure into a pass. A receiver can use a valid ARC chain for a local-policy override and record that decision in aggregate reporting. Adoption is not universal, so strong DKIM coverage and report-based rollout decisions remain necessary.
Views from the trenches
Best practices
Classify connecting IPs before fixing anything; ownership changes the next action.
Use t=y for standards-based testing; remove pct because RFC 9989 omits that tag.
Keep DKIM on every stream so forwarded mail has a reliable path after SPF changes.
Common pitfalls
Assuming unfamiliar relay IPs are spoofing leads teams to chase normal forwards.
Using pct for gradual enforcement now relies on an obsolete, inconsistent mechanism.
Expecting SRS alone to restore DMARC ignores identifier alignment with visible From.
Expert tips
Investigate owned failing IPs first; forwarded failures usually show another source.
Compare MAIL FROM, visible From, and DKIM d= results before deciding a stream is safe.
Use volume and recurrence, not one unusual row, to decide whether a relay matters.
Expert from Email Geeks says DMARC reports are meant to show mail using your visible From domain that was not authenticated by you.
2020-02-14 - Email Geeks
Expert from Email Geeks says forwarded mail often appears in aggregate reports because forwarding commonly breaks SPF or DKIM in transit.
2020-02-14 - Email Geeks
Next steps for forwarded mail
Forwarding is normal, and it will keep showing up in DMARC reports. Make controlled senders pass, keep DKIM strong enough to survive ordinary forwarding, and measure the forwarded mail that fails before enforcing quarantine or reject.
Review failing rows by source ownership. Fix owned IPs first. Check authorized senders for SPF and DKIM setup. Classify customer domains, vanity-domain relays, and mailing lists as indirect flows only when the evidence supports it. Once that picture is clear, enforcement becomes a controlled policy decision rather than a guess.
