Email Forwarding That Bounces Back

Mail that went somewhere else

Plenty of small businesses never set up a mailbox for their own domain. The address on the website forwards everything to someone's personal Gmail, an arrangement set up years ago in a few minutes.

Most days it works. Then a customer mentions that their email came back, a supplier says they wrote twice, or a message turns up in the spam folder a week late.

Nothing on your side looks broken, because nothing on your side keeps a copy. The forwarding server passes each message on and forgets it.

And when the receiving service refuses one, the bounce goes to the person who wrote to you, not to you.

Why forwarded mail looks suspicious

• The wrong sender: it arrives from your host, carrying someone else's address.
• Failed checks: the sender's domain never authorised your host to send for it.
• Strict policies: some domains tell receivers to refuse mail failing those checks.
• Altered messages: a tag added in transit breaks the sender's signature.
• Forwarded spam: everything sent to the address is passed on, junk included.
• Size limits that differ between your host and the receiving service.

The fifth is the one that spreads. The receiving service sees a stream of spam arriving from your host's server, concludes the server sends spam, and grows suspicious of everything it passes on, including the genuine mail.

What forwarding does to the checks

Receiving services test each message against the sender's own domain: is the server delivering it on that domain's list of approved senders, and does the message still carry an intact signature from the original server?

A plainly forwarded message fails the first test, because your host's server is on nobody's list but your own.

It can still pass on the signature, if nothing in the message changed on the way. When something did, or when there was no signature to begin with, nothing is left to vouch for it.

Google said earlier this year that gmail.com would ask receivers to reject mail that claims a gmail.com sender but fails both tests.

That leaves forwarded mail from Gmail users especially fragile: a forwarding server that alters messages can turn an ordinary email into a rejection.

Where the bounce goes

When a forwarded message is refused, your host's server has to tell someone, and it tells the original sender.

So the customer receives a delivery failure from your domain, written in server language, and concludes the address is dead.

You see nothing, because the message never existed in any mailbox you own.

Messages accepted but filed as spam are worse: no bounce, no trace, and a customer who believes you ignored them.

A worked example

A three-person indie game studio registered its domain and switched on the free forwarding that came with it: hello, press and support, each pointing at a founder's personal Gmail.

While the game was in development, little mail arrived and most of it got through. When a trailer went out ahead of a festival showing, the support address began receiving spam in quantity.

Gmail started treating the forwarding server as a spam source. Messages from journalists and festival organisers landed in spam or not at all, and some of them received bounces from the studio's own address.

The mechanism was simple: all of it, junk included, reached Gmail from one server, carrying senders' addresses that server had no right to send for.

The studio moved to real mailboxes on its domain, with spam filtering at the mailbox, published its own sending records and switched forwarding off. The founders read their mail in the same phone apps as before.

Host the mailbox properly

The fix is a real mailbox for each address in use, on a mail service that filters spam before anything is passed anywhere.

That can be the email included with your hosting, or a business service such as Office 365 or Google Apps for Work. Each gives the address its own storage, its own spam filter and a copy of everything received.

The mail is then read over IMAP on the phone and the computer, with the same folders on both and nothing lost in between.

If you want it all in one inbox

Some owners like everything in their personal Gmail. That still works without forwarding.

Gmail can collect mail from another mailbox every so often, and send replies as the business address through the business mail server.

Collecting differs from forwarding in the way that matters. The mail is filtered and stored in your own mailbox first, and Gmail fetches it as the account holder rather than receiving it from a stranger.

Replies sent through the business server also pass the checks for your own domain, which keeps them out of customers' spam folders.

Records for your own domain

While the mailbox is being set up, publish SPF and DKIM records for your domain, the approved-sender list and the signature described above, so mail you send is recognised as yours.

A DMARC record in monitoring mode then asks receiving services to send reports on mail using your domain. Those reports show anything else, such as the website's form, sending in your name.

Whoever looks after your hosting can add all three in an afternoon.

Test it from outside

Send a message to the business address from a gmail.com account and from an Outlook.com account, and check where each one lands.

Send one with an attachment of a few megabytes too, since size limits differ between services.

Repeat the tests after the changeover and once a year after that. With a real mailbox there is also, finally, a log your host can check when something goes missing.

The counter-case

Forwarding is fine for an address that receives little and matters little, such as an old domain kept only so stray mail still reaches you.

Some hosts also rewrite the sender on forwarded mail, so the first test is made against the host's own domain and passes. That helps, but strict policies still depend on the signature, and forwarded spam still damages the server's standing.

For the addresses customers and suppliers actually use, host a proper mailbox and collect from it rather than forwarding.

The changeover

1. List every address that forwards anywhere.
2. Note who reads each one and where.
3. Create a real mailbox for each address in use.
4. Turn on spam filtering at the mailbox.
5. Publish SPF and DKIM records for your domain.
6. Set phones and Gmail to collect, not receive forwards.
7. Send test messages from two outside accounts.

Step three is the change that matters. Once mail stops reaching Gmail from a server claiming to be someone else, there is nothing left for it to distrust.

Mail sent in a customer's name runs into the same checks, as covered in website forms that send from the customer's Gmail address.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.