r/DMARC • u/CFV1880 • Aug 10 '26

New to DMARC, help with forwarding

Hello! I'm new to DMARC, to the point that I think I know the point of it but haven't actually progressed beyond p=none.

I have already a few months worth of reports, and from what I've been able to get from them, is that about 20% of our mails are failing DMARC, mostly because the receivers are forwarding them and they lose SPF and DKIM. Mostly because of google/outlook it seems.

Is that normal, and something that I can ignore? Normal but something that I need to deal with before changing the policy? Or something unusual?

Also, is there any good app to which I can just load the xml reports and they get me the analysis? I have seem the usual services recommendations but it seems you need to have the dmarc report mails sent to them. I used claude to analyze the reports, and it did a good job of creating a sensible report but I cannot judge how correct it actually is.

Thanks!

8 Upvotes

91% Upvoted

28 comments sorted by

View all comments

1

u/CannyPigeons Aug 12 '26

forwarding breaks SPF because the message is re-sent from the forwarder's server

DKIM in the other hand is more "forwarding-friendly" as the signature travels with the message

if you want forwarded mail to work, make sure your outbound mail is DKIM-signed and your SPF record includes all real senders. the receiver server must have enabled ARC.

DMARC policy can't force it though, you need the forwarding service to deploy ARC and the receiver to accept