4 ms·

One thing the April changes break is forwarding between e-mail services. If you currently forward from say an old university address at foo@school.edu to a pers

One thing the April changes break is forwarding between e-mail services. If you currently forward from say an old university address at foo@school.edu to a personal GMail account at bar@gmail.com that will no longer work. This must be relatively uncommon if the major providers are charging ahead with these changes but it's pretty annoying for the people affected.

Ayesh 3y ago
Why will it no longer work? When you forward an email, unless the email forwarder modifies the message content, it should still match the DKIM signature, so it still passes.
- hedgehog 3y ago
  I don't know the details but my rough understanding is after forwarding the next hop delivery will fail SPF.
  - bo1024 3y ago
    Yeah, with forwarding, I am seeing DKIM still passes but SPF fails.
    - tmn007 3y ago
      We are seeing all the unix forwarders setup a decade+ ago are dead in the water now (have to be replaced with mailing list software)
    - therein 3y ago
      This explains why I have been unable to get my 2FA from Adobe.
  - patja 3y ago
    That's my understanding as well, but I also understand that the email will pass DMARC if either SPF or DKIM passes, and DKIM will still pass on forwarded email.
whelp_24 3y ago
That seems really significant, email fowarding won't work anymore?
jeffbee 3y ago
This isn't a change. SPF has always broken forwarders that don't touch the envelope from address, and that is right and proper. You can still forward mail, but your forwarder must rewrite the return path.
- hedgehog 3y ago
  It's is a change in mail service behavior, and arguably either a broken policy or broken spec (not sure and don't really care since the effect is the same). "In April 2024, Google will start rejecting a percentage of non-compliant email traffic and gradually increase the rejection rate. For example, if 75% of a sender’s traffic meets our requirements, Google will start rejecting a percentage of the remaining 25% of traffic that isn’t compliant." https://dmarcian.com/yahoo-and-google-dmarc-required/ https://dmarcian.com/yahoo-and-google-dmarc-required/
  - Avamander 3y ago
    It's really not a change or any of those. Mail services have behaved this way in some form or way for a while, these specs have worked like this from the start and the policy is only a logical conclusion of it all. Untrusted forwarders (also sometimes known as open relays) have been heavily frowned upon for a really long time. SPF has never worked for forwarders that don't do rewriting. Those letters have always been negatively looked upon, unauthenticated mail is a remnant of times long gone. Google's policies about authentication are the bare minimum you should be doing anyways if you care even a little bit about your customers or recipients in general.
- hannob 3y ago
  This is something I'm still trying to find someone who understands it in detail and can explain it to me. Because as you say, you break SPF if you don't touch the envelope from. There's SRS to fix this. But if you do that, you break DMARC alignment. So... something is always broken? It appears to me there's no way to make mail forwarding that works with full SPF/DKIM/DMARC setups.

Ayesh 3y ago

Why will it no longer work? When you forward an email, unless the email forwarder modifies the message content, it should still match the DKIM signature, so it still passes.

hedgehog 3y ago
I don't know the details but my rough understanding is after forwarding the next hop delivery will fail SPF.
- bo1024 3y ago
  Yeah, with forwarding, I am seeing DKIM still passes but SPF fails.
  - tmn007 3y ago
    We are seeing all the unix forwarders setup a decade+ ago are dead in the water now (have to be replaced with mailing list software)
  - therein 3y ago
    This explains why I have been unable to get my 2FA from Adobe.
- patja 3y ago
  That's my understanding as well, but I also understand that the email will pass DMARC if either SPF or DKIM passes, and DKIM will still pass on forwarded email.

whelp_24 3y ago

That seems really significant, email fowarding won't work anymore?

jeffbee 3y ago

This isn't a change. SPF has always broken forwarders that don't touch the envelope from address, and that is right and proper. You can still forward mail, but your forwarder must rewrite the return path.

hedgehog 3y ago
It's is a change in mail service behavior, and arguably either a broken policy or broken spec (not sure and don't really care since the effect is the same). "In April 2024, Google will start rejecting a percentage of non-compliant email traffic and gradually increase the rejection rate. For example, if 75% of a sender’s traffic meets our requirements, Google will start rejecting a percentage of the remaining 25% of traffic that isn’t compliant." https://dmarcian.com/yahoo-and-google-dmarc-required/ https://dmarcian.com/yahoo-and-google-dmarc-required/
- Avamander 3y ago
  It's really not a change or any of those. Mail services have behaved this way in some form or way for a while, these specs have worked like this from the start and the policy is only a logical conclusion of it all. Untrusted forwarders (also sometimes known as open relays) have been heavily frowned upon for a really long time. SPF has never worked for forwarders that don't do rewriting. Those letters have always been negatively looked upon, unauthenticated mail is a remnant of times long gone. Google's policies about authentication are the bare minimum you should be doing anyways if you care even a little bit about your customers or recipients in general.
hannob 3y ago
This is something I'm still trying to find someone who understands it in detail and can explain it to me. Because as you say, you break SPF if you don't touch the envelope from. There's SRS to fix this. But if you do that, you break DMARC alignment. So... something is always broken? It appears to me there's no way to make mail forwarding that works with full SPF/DKIM/DMARC setups.