Understanding How Strict SPF and DMARC Settings Affect Email Delivery

This article explains how a strict SPF and DMARC policy can impact delivery, and outlines workarounds and recommendations for Webvault customers.

How SPF and DMARC Work Together

SPF (Sender Policy Framework)

SPF allows domain owners to specify which mail servers are authorized to send email on behalf of their domain. For example, the recommended SPF record for Webvault customers is:f

v=spf1 include:mailsolutions.com.au -all

This record authorizes mailsolutions.com.au (and by extension, Webvault’s outbound mail servers) to send email for your domain. Any message coming from an unauthorized server will fail SPF.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC builds on SPF and DKIM to provide instructions to receiving mail servers on what to do if an email fails authentication checks. The DMARC policy used on the Webvault network is:

v=DMARC1; p=reject; aspf=s

This strict policy instructs receiving servers to reject messages that fail both SPF and DKIM authentication checks. The aspf=s setting enforces strict SPF alignment, meaning the domain in the Return-Path (envelope sender) must exactly match the domain in the From: header.

For the correct SPF and DMARC settings for Webvault-hosted domains, refer to this knowledge base article: SPF and DMARC Records for Email Hosting

The Forwarding Problem

When a recipient forwards your email (e.g., from a company address to a Gmail inbox), the forwarding mail server acts as a new sending source. Since this server isn't included in your SPF record, SPF fails.

With aspf=s, even minor differences between the envelope sender and header From: domain can cause SPF alignment to fail. If you are not signing emails with DKIM or the DKIM signature doesn't align with your domain, the message will also fail DMARC. If your DMARC policy is set to reject, the recipient's mail server may bounce the email entirely, even though it originated from an authorized source.

Workarounds and Solutions

1. Request the Final Delivery Address

If you’re aware the recipient is forwarding emails, ask them to provide their actual destination email address (e.g., Gmail, Outlook). Sending directly to that address bypasses intermediate forwarding and avoids SPF failures.

2. Implement DKIM with Domain Alignment

Ensure your messages are signed with a DKIM signature aligned to your sending domain (e.g., d=yourdomain.com). DKIM survives forwarding because it signs the contents of the message rather than depending on the sending IP.

3. Relax the SPF Mechanism

You can change -all to ~all or ?all in your SPF record:

• ~all (SoftFail): Acceptable but marked as suspicious.

• ?all (Neutral): No policy.

However, this weakens your protection against spoofing and phishing attacks, especially when used with strict DMARC enforcement.

4. Relax the DMARC Policy

Change the policy from p=reject to p=quarantine or p=none:

• p=quarantine: Mail is accepted but may go to the recipient's spam folder.

• p=none: Mail is accepted with no enforcement — only reporting.

⚠️ Security Risk: These changes reduce protection against spoofed messages claiming to come from your domain, particularly when used with strict alignment like aspf=s.

Recommendations

• Use DKIM signing for all outbound email with domain alignment.

• Keep SPF strict (-all) and DMARC in enforcement mode only after ensuring DKIM is functioning correctly.

• Monitor SPF and DKIM alignment using DMARC aggregate reports.

• Only relax SPF or DMARC settings if necessary and with full awareness of the associated risks.

• Always encourage recipients to provide their direct, final delivery address to avoid issues caused by forwarding.