4 ms·

> Cloudflare Email Routing service acts as an intelligent router at the transport layer, handling and modifying the SMTP envelope to deliver the message at its

> Cloudflare Email Routing service acts as an intelligent router at the transport layer, handling and modifying the SMTP envelope to deliver the message at its final destination but preserving the original headers and keeping the body intact. This approach ensures that things like SPF, DKIM, and other security or anti-spam protocols don't break and the recipient stays protected. My understanding is that this is not technically feasible in some scenarios. Especially the one where the sender has SPF and DMARC, but not DKIM. In that case you can't keep the envelope sender address (SMTP MAIL FROM) as is when forwarding because that would fail SPF at the recipient. But if you rewrite the envelope sender address, then that will fail DMARC at the recipient (due to the SPF Authenticated Identifier being out of alignment with the header From, see RFC 7489). So no matter what you do, the message will fail validation at the recipient. I guess you could change the From header to bring it back into alignment, and that would work because DKIM is not being used, but now the recipient end user will see an incorrect sender address… If you managed to solve this problem then I'd be really curious to know how!

kureikain 5y ago
Yes, I was confused as well because without rewriting SMTP MAIL FROM(or Return Path or Envelop) then SPF will definetely fail. However, even if SPF failed, and DKIM is passed, it can still be trust worthy. Also, if the mail server support ARC(which gmail, for example, does) we can append our ARC so mail provider can look into it to investigate email forwarding chain.
- edechamps 5y ago
  > However, even if SPF failed, and DKIM is passed, it can still be trust worthy. Yes. The problem is that some senders use SPF+DMARC, but not DKIM. It is fundamentally impossible to forward emails from these senders in a way that will look valid to the recipient. > if the mail server support ARC(which gmail, for example, does) we can append our ARC so mail provider can look into it to investigate email forwarding chain The problem with ARC is that just adding the header does nothing on its own; the recipient must also trust the forwarder to provide legitimate authentication results. ARC does not provide any mechanism for that trust to be extended automatically. So unless GMail makes a manual, conscious, explicit business decision to trust Cloudflare, an ARC header added by Cloudflare won't have any effect on GMail recipients.

kureikain 5y ago

Yes, I was confused as well because without rewriting SMTP MAIL FROM(or Return Path or Envelop) then SPF will definetely fail. However, even if SPF failed, and DKIM is passed, it can still be trust worthy. Also, if the mail server support ARC(which gmail, for example, does) we can append our ARC so mail provider can look into it to investigate email forwarding chain.

edechamps 5y ago
> However, even if SPF failed, and DKIM is passed, it can still be trust worthy. Yes. The problem is that some senders use SPF+DMARC, but not DKIM. It is fundamentally impossible to forward emails from these senders in a way that will look valid to the recipient. > if the mail server support ARC(which gmail, for example, does) we can append our ARC so mail provider can look into it to investigate email forwarding chain The problem with ARC is that just adding the header does nothing on its own; the recipient must also trust the forwarder to provide legitimate authentication results. ARC does not provide any mechanism for that trust to be extended automatically. So unless GMail makes a manual, conscious, explicit business decision to trust Cloudflare, an ARC header added by Cloudflare won't have any effect on GMail recipients.