Forwarding and mailing lists

After this lesson you can

Separate the mail you can fix from the mail nobody can, and say which is which.

Assumes you have read Four causes, one method.

Some DMARC failures belong to a sender you can go and fix. Some belong to an intermediary that is behaving reasonably and will not change for you. Separating the two is what stops an enforcement project stalling on a residual that was never going to reach zero.

Three shapes

Path	SPF	DKIM	Fixable by you?
Plain forwarding	Fails — relay IP not authorised	Survives	Yes, by having aligned DKIM at all
List that modifies the message	Fails	Fails — subject tag or footer	No
List that rewrites From	Fails for you	Fails for you	Not applicable — it is no longer your From domain

The first row is the argument for DKIM in a sentence: with an aligned signature, forwarded mail still passes DMARC; without one, it cannot. A domain resting on SPF alone has no margin at all here.

Lists are not fixable

A list that prepends [list-name] to the subject and appends a footer breaks both mechanisms, and it does so as a consequence of doing its job. Nothing in your configuration changes that.

ARC lets a receiver that trusts the list honour the original result. It is a receiver-side choice.
Well-run lists now rewrite the From header to their own domain, which sidesteps the problem entirely and is why this is less common than it was.
The residual is real and should be quantified, named as a list, and accepted — not chased.

Telling them apart in reports

SPF fail + DKIM pass, unfamiliar IP
   -> forwarding. Aligned DKIM is carrying it. DMARC passes.

SPF fail + DKIM fail, unfamiliar IP, small steady volume
   -> a list, or a forwarder that modifies. Investigate the IP once,
      then accept.

SPF fail + DKIM fail, unfamiliar IP, large or spiky volume
   -> not forwarding. Treat as spoofing until shown otherwise.

Volume shape is the discriminator. Forwarding and lists produce small, steady, persistent streams from a stable set of hosts. Spoofing arrives in bursts from addresses that change.

This residual does not block enforcement

A known forwarding and list residual of a percent or two is a reason to proceed carefully, not a reason to stay at p=none indefinitely. The mail affected is mail a human forwarded or subscribed to a list with, and both audiences are far more tolerant of a delivery problem than the audience for your transactional mail is of a spoof.

Knowledge check

Reports show a source with SPF failing and DKIM passing, from an IP you do not recognise. What is it?

Almost certainly forwarding — the relay is not in your SPF record, and the signature travelled with the message intact.
Spoofing — an attacker who obtained your DKIM key.
A misconfigured vendor that needs adding to your SPF record.
A list, which would have broken the signature.

Correct — Almost certainly forwarding — the relay is not in your SPF record, and the signature travelled with the message intact. That is the signature of a plain forward, and DMARC passes on the aligned DKIM. It is also the clearest demonstration of why DKIM is worth having on a domain with a perfect SPF record.

Not this — Spoofing — an attacker who obtained your DKIM key. Possible and extremely unlikely. A stolen key would be an exceptional event; forwarding is a daily one, and both produce this shape.

Not this — A misconfigured vendor that needs adding to your SPF record. A vendor sending on your behalf would have an aligned SPF result once added. A forwarding relay cannot be enumerated and should never be added to SPF.

Not this — A list, which would have broken the signature. A modifying list breaks DKIM. The passing signature is what rules that out.

Last reviewed 2026-09-15

Forwarding and mailing lists

Three shapes

Lists are not fixable

Telling them apart in reports

Try it on a real domain

Go deeper