3 ms·
Yes, I was confused as well because without rewriting SMTP MAIL FROM(or Return Path or Envelop) then SPF will definetely fail. However, even if SPF failed, and
by kureikain 5y ago
Yes, I was confused as well because without rewriting SMTP MAIL FROM(or Return Path or Envelop) then SPF will definetely fail.
However, even if SPF failed, and DKIM is passed, it can still be trust worthy. Also, if the mail server support ARC(which gmail, for example, does) we can append our ARC so mail provider can look into it to investigate email forwarding chain.
- edechamps 5y ago> However, even if SPF failed, and DKIM is passed, it can still be trust worthy. Yes. The problem is that some senders use SPF+DMARC, but not DKIM. It is fundamentally impossible to forward emails from these senders in a way that will look valid to the recipient. > if the mail server support ARC(which gmail, for example, does) we can append our ARC so mail provider can look into it to investigate email forwarding chain The problem with ARC is that just adding the header does nothing on its own; the recipient must also trust the forwarder to provide legitimate authentication results. ARC does not provide any mechanism for that trust to be extended automatically. So unless GMail makes a manual, conscious, explicit business decision to trust Cloudflare, an ARC header added by Cloudflare won't have any effect on GMail recipients.