Forwarding changes the network identity SPF evaluates
SPF authorizes the IP sending a message for the envelope sender domain. When an intermediary forwards the message, the destination sees the forwarder’s IP rather than the original sender’s IP. If the envelope sender remains unchanged, an otherwise legitimate message can fail SPF at the final destination.
SRS changes the envelope identity to preserve SPF logic
Sender Rewriting Scheme is used by some forwarders to rewrite the envelope sender so the forwarded hop can authenticate under a domain the forwarder controls. SRS addresses the SPF problem at the envelope layer. It does not preserve the original sender’s SPF result as if no forwarding occurred.
ARC preserves an authenticated chain of observations
Authenticated Received Chain lets intermediaries record authentication results and seal them as the message moves through forwarding or modification. A final receiver can use that chain as additional evidence. ARC does not make a malicious message trustworthy by itself; it protects the integrity of the intermediate authentication story.
Diagnose forwarding from a real header
Look at the Received chain, Authentication-Results and ARC sets together. A current DNS check alone cannot tell you whether an intermediate hop rewrote the envelope, preserved authentication evidence or modified the message body in a way that invalidated DKIM.
Verify the evidence
Use the Email Infrastructure Digital Twin to establish the public control plane, then inspect message-level evidence with Email Header Forensics.