Authentication

Email Forwarding, SPF, SRS and ARC: Why Authentication Changes in Transit

Understand why forwarded messages can break SPF and how SRS and ARC preserve different kinds of evidence.

10 minUpdated 2026-08-17

Forwarding changes the network identity SPF evaluates

SPF authorizes the IP sending a message for the envelope sender domain. When an intermediary forwards the message, the destination sees the forwarder’s IP rather than the original sender’s IP. If the envelope sender remains unchanged, an otherwise legitimate message can fail SPF at the final destination.

SRS changes the envelope identity to preserve SPF logic

Sender Rewriting Scheme is used by some forwarders to rewrite the envelope sender so the forwarded hop can authenticate under a domain the forwarder controls. SRS addresses the SPF problem at the envelope layer. It does not preserve the original sender’s SPF result as if no forwarding occurred.

ARC preserves an authenticated chain of observations

Authenticated Received Chain lets intermediaries record authentication results and seal them as the message moves through forwarding or modification. A final receiver can use that chain as additional evidence. ARC does not make a malicious message trustworthy by itself; it protects the integrity of the intermediate authentication story.

Diagnose forwarding from a real header

Look at the Received chain, Authentication-Results and ARC sets together. A current DNS check alone cannot tell you whether an intermediate hop rewrote the envelope, preserved authentication evidence or modified the message body in a way that invalidated DKIM.

Verify the evidence

Use the Email Infrastructure Digital Twin to establish the public control plane, then inspect message-level evidence with Email Header Forensics.

Primary references