[ Troubleshooting & reporting ]
Forwarding and interoperability
Keep authentication intact through forwarding, mailing lists, gateways and ARC.
24 guides
[ All guides ]
Guide
ARC explained through authentication assertions and trust decisions
Understand ARC as carried authentication assertions whose usefulness depends on validation and a separate receiver trust decision.
Guide
ARC validation and the receiver's trust in an intermediary
Make ARC validation and intermediary trust separate, reviewable decisions with bounded exceptions and negative tests.
Guide
Authenticated remailing: who owns each boundary?
Map remailing responsibilities across envelope changes, DKIM, DMARC alignment, ARC and SMTP handoffs, with explicit evidence and receiver boundaries.
Guide
Disclaimers, banners and message-authentication results
Evaluate disclaimers and warning banners using rule scope, DKIM coverage, authentication timing, fallback wrapping and controlled direct and indirect samples.
Guide
Distribution groups, shared mailboxes and lists: trace the flow
Distinguish distribution groups, shared mailboxes and mailing lists by tracing SMTP envelopes, content changes, signatures and trusted receiver results.
Guide
DKIM and forwarding: identify message modifications
Locate the transformation that invalidates DKIM, separating canonicalization, body coverage and signer placement.
Guide
Document exceptions for business-critical indirect mail flows
Record a narrow, expiring exception for a demonstrated indirect-mail failure rather than weakening authentication for an entire domain.
Guide
Email signature services and DKIM breakage
Investigate signature-service DKIM failures by locating content insertion, inspecting MIME and canonicalization, and verifying authorized aligned signing order.
Guide
Forwarding into Gmail using current provider guidance
Investigate forwarding into Gmail with current Google guidance, envelope and signature comparisons, conditional DKIM effects and explicit evidence gates.
Guide
Inspect the actual forwarding route into Microsoft hosted mail
Review forwarding into Microsoft-hosted mail by route and account type, separating SRS, DKIM, DMARC and composite results before an approved change.
Guide
Investigate indirect mail before changing sender policy
Investigate forwarded and indirect-mail failures using matched samples, trusted results, signature comparisons and scoped policy decisions before changes.
Guide
Long-term planning for indirect mail while ARC and DKIM2 proposals evolve
Keep existing indirect-mail controls grounded in observed behavior while tracking version-pinned ARC retirement and DKIM2 proposals.
Guide
Mailing lists and DMARC: understand rewriting and redistribution
Evaluate mailing-list redistribution as a distinct identity and content transformation rather than a transparent forward.
Guide
Mailing-list From rewriting: replies and identity
Evaluate mailing-list From rewriting by comparing aligned authentication, original attribution, Reply-To, list headers and observed reply destinations.
Guide
Maintain alumni forwarding for long lived university addresses
Review alumni forwarding as a maintained service: receiving versus sending, destination ownership, signature preservation and realistic evidence-led commitments.
Guide
Microsoft SRS abuse research: distinguish remailing behaviour from DMARC bypass claims
Read Microsoft SRS abuse research as a dated identity-flow finding, and separate downstream alignment from the authorization of the original message.
Guide
Read ARC headers without treating a chain as automatic authorisation
Read ARC fields in instance order while preserving the difference between syntax, cryptographic verification and authorization.
Guide
Security gateways that modify signed mail
Diagnose DKIM failures around security gateways using raw before-and-after messages, covered changes, signer placement and trustworthy authentication results.
Guide
Sender Rewriting Scheme: what it changes and what it cannot prove
Use SRS to understand rewritten envelopes and bounce routing without mistaking it for author authentication.
Guide
Separate support ticket forwarding from notification alignment
Investigate support-ticket forwarding by separating customer ingestion and new notifications, conditional DKIM effects, aligned identities and trusted results.
Guide
SPF and forwarding: follow the envelope and connecting IP
Follow the actual connecting IP and envelope domain at each forwarding hop before changing SPF.
Guide
Test a forwarding path before moving a domain to stricter policy
Test representative direct and forwarded messages, including modifications and failures, before increasing DMARC enforcement.
Guide
Trace forwarding rules across mixed email providers
Trace mixed-provider forwarding with a route inventory, per-hop envelope and signature evidence, provider-specific scope and change acceptance criteria.
Guide
Why legitimate forwarded mail can fail DMARC
Diagnose forwarding failures by tracing the aligned authentication path that was lost, rather than treating every failure as spoofing.
Related free tools
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption
[ More in Troubleshooting & reporting ]