Skip to content
healthcheck.email Sign in

Known quirk

Forwarded mail can fail SPF, so DMARC rests on DKIM

When someone forwards your email, or a mailing list resends it, SPF usually fails along the way. That's normal. DKIM is what keeps it passing, so every service that sends as you should sign with DKIM.

What this means for you

  • Nothing to change if your senders sign with DKIM.
  • In DMARC reports, some forwarded mail shows SPF failing. That's expected.
  • Mailing lists that change the message can break DKIM too; their reports aren't a gap in your setup.

Why it happens

SPF checks which server sent the mail. A forwarder's server isn't one you allowed, so SPF fails. DKIM signs the message itself, so it survives forwarding as long as nobody changes the message.

Technical detail

With indirect mail flows, SPF fails unless the forwarder is authorized by the originator, so DKIM must supply the DMARC-relevant result (RFC 7960 §2.2). Mailing lists commonly modify headers or content in ways that break DKIM (RFC 7960 §3.2.3).

forwarding.spf_breaks

Sources

Reviewed by healthcheck.email on 2026-10-09.