Forwarded email, SPF failures and the governance gap teams miss

TL;DR: Forwarded email can fail SPF even when it is legitimate, because SPF checks the sending IP at each hop while forwarding changes that IP, according to Valimail. DKIM is more resilient because it signs the message itself, making alignment and key management the critical controls for DMARC stability.

Editorial analysis by NHI Mgmt Group, based on content published by Valimail: “Why forwarded emails break SPF (and how DKIM solves it)”.

Key questions

Q: Why does forwarded email fail SPF even when the message is legitimate?

A: SPF checks the IP address of the server that delivers the message at the recipient boundary.

Q: When should organisations rely on DKIM instead of SPF for forwarded mail?

A: Use DKIM as the primary success signal when forwarding, mailing lists or relays are part of normal mail flow.

Q: What are the warning signs that email authentication is misaligned with forwarding?

A: Common signs include DMARC failures on otherwise expected mail, SPF failures that only appear after messages pass through a forwarder, and DKIM failures tied to disclaimers, footers or gateway rewriting.

Practitioner guidance

• Validate forwarding-heavy mail flows separately Test mailbox forwarding, mailing lists and gateway relays as distinct delivery paths so you can see where SPF fails and whether DKIM still aligns.
• Keep SPF limited to authorised senders Avoid adding arbitrary forwarding services to SPF records, because that expands the set of systems allowed to send for the domain and weakens spoofing resistance.
• Prioritise DKIM alignment for forwarded mail Sign the visible From domain and the headers that DMARC depends on, then review any downstream system that modifies bodies, headers or routing.

Bottom line: Forwarding breaks SPF because the evaluated sending IP changes, not because the message is necessarily fraudulent.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →