Follow the connection that SPF sees

For direct delivery, the receiver evaluates whether the original sender’s connecting IP is authorized by the selected SPF identity. With forwarding, the final receiver sees a connection from the forwarder instead. If the forwarder preserves the original SMTP MailFrom, that new IP may not be authorized by the original domain, so SPF can return a different result.

This is expected from SPF’s design. Adding every possible forwarder to the original sender’s policy is neither practical nor safe.

Compare two message paths

Send one controlled message directly and one through an authorized forwarding route. For each final copy, record:

  • the peer IP observed by the trusted receiver;
  • the SPF identity and result;
  • DKIM signing domains and results;
  • the visible From domain and DMARC result;
  • evidence added by intermediaries, including ARC where present.

DKIM may survive forwarding when signed content is not changed. It may fail when a forwarding or mailing-list system modifies signed headers or body content. DMARC needs an aligned pass from SPF or DKIM; a changed SPF result does not necessarily mean DMARC fails if an aligned DKIM signature still verifies.

Understand mitigations without overclaiming

Some forwarders rewrite the envelope sender using a Sender Rewriting Scheme so their own domain can authorize the forwarded connection and receive bounces. That changes the SPF identity; it does not make the original domain’s SPF pass. ARC can carry authenticated evidence about prior handling, but RFC 8617 does not force a receiver to trust a chain or deliver a message. Receiver policy still decides how to use it.

Do not “fix” forwarding by weakening the original SPF policy without evidence. Do not interpret an ARC seal as proof that the message is benign.

Diagnose the affected route

Confirm whether the actual problem is an SMTP rejection, DMARC failure, or mailbox placement observation. Ask the forwarding operator for its documented envelope and ARC behavior. Preserve the direct-delivery baseline and retest after any controlled change.

The handover should state which hop changed the IP, which identity SPF evaluated, whether DKIM survived, and what the final receiver reported. That is more actionable than saying “forwarding breaks authentication,” because it identifies the mechanism and the path that need attention.