Forwarding changes a message’s delivery path and can break authentication that passed at the original recipient. Investigate the forwarding service and recipient-side results rather than assuming the original sender is fraudulent or that all authentication should be disabled.
Understand why SPF can change
SPF checks the server delivering the message against the envelope sender’s policy. After forwarding, that server may be the forwarder rather than the original authorized sender. The original domain’s SPF policy may not authorize it.
Google recommends appropriate envelope-sender handling by forwarding administrators and correct SPF for the forwarding service. Do not add an unfamiliar forwarder’s infrastructure to the original sender’s policy without verifying ownership and authority.
Check whether DKIM survived
A valid DKIM signature can survive forwarding if the signed content and headers remain intact. Adding a footer, rewriting the subject, re-encoding the body, or modifying protected headers can break it.
DMARC needs an authenticated, aligned SPF or DKIM result. A forwarded message can therefore have a different outcome depending on which identifier still aligns with the visible From domain. Compare full headers from the actual recipient, not just the original sender’s copy.
Use ARC as evidence, not a delivery guarantee
Authenticated Received Chain, described in RFC 8617, lets participating intermediaries preserve signed assertions about authentication assessments along the path. Receiving systems can use that evidence in their disposition decisions.
ARC does not force Gmail or another receiver to accept every forwarded message, and a header merely named ARC is not proof of a trustworthy chain. Keep spam filtering active, avoid forwarding known spam, and work with the forwarder’s administrator to preserve authentication correctly. Do not apply a blanket allowlist for an entire shared provider to repair one message. Verify a new controlled test and record the specific route that changed.
Browse Gmail & Google Account help
References
- Best practices for forwarding email to Gmail
- Set up DMARC | Security & data protection | Google Workspace Help
- RFC 8617: The Authenticated Received Chain (ARC) Protocol
Reviewed against the linked product guidance, standards, and identified vendor or public-authority guidance on October 29, 2026. Available options and screen labels can vary by account, device, region, and organization policy.