Forwarded and mailing-list mail fails DMARC
On every plan
When someone forwards your mail, or a mailing list sends it on, the mail reaches the recipient from a server that is not yours. SPF fails, because your SPF record does not list that server. DKIM usually survives a plain forward, because the signature travels with the message, but a list that changes the message breaks it. If your own sources pass, there is nothing to fix on your side.
What the explanations say
The Explanation on the Sources page names these cases:
- DKIM passes, SPF fails. The DKIM signature survived, and the mail passes DMARC. Forwarding is one cause. A sending service missing from your SPF record is the other, and the explanation names the source, so check whether it is one of yours. If it is, fix your SPF record: the explanation adds that Gmail and Outlook.com ask bulk senders for SPF to pass as well as DKIM.
- Recognised as forwarded. The mailbox provider marked the mail as forwarded in its report, although it failed DMARC. The sentence says what the provider then did: delivered it, sent it to the spam folder, or refused it.
- A mailing list. The list sent the mail on with changes, which broke the signatures, and the mailbox provider delivered it anyway.
- The mailbox provider's own rule. The provider applied a rule of its own instead of your policy, and the explanation names the rule.
We show the last three only when the mailbox provider says so in its report.
Make sure your own mail carries DKIM
Mail that passes on SPF alone fails as soon as someone forwards it. When a source passes with SPF but has no DKIM signature for your domain, its explanation says so and tells you to set up DKIM in that service. That is the change on your side that helps forwarded mail. For a service that cannot sign mail with your domain, the explanation says that instead, and the DKIM guide lists the choices you have.
If DKIM is set up and the source still fails, see I set up DKIM, but the source still fails.
Forwarding and a stricter policy
Forwarded mail does not have to hold back a stricter policy. The Readiness page counts a source only when it carries enough of your mail, and the rule on that page says how much. The same page says what, if anything, holds back the next step.
Under quarantine or reject, a mailbox provider may still deliver forwarded mail under a rule of its own. The explanations above show when it did, and when it sent the mail to spam or refused it.
When the forwarding address is yours
If the forwarding address is your own, for example a work mailbox that forwards to a personal one, the change that helps is made where the mail is forwarded, not in your DMARC record. The guide Why does forwarded mail fail DMARC? lists what the forwarding service can change.
Published 27 October 2026 · Checked 27 October 2026