Forwarded email rejected: why forwarding fails SPF and DMARC

Short answer: Forwarding sends the message on from a different server, so SPF fails, and DMARC then passes only if the original DKIM signature survives. Fix: the original sender DKIM-signs with their own domain; the forwarder rewrites the sender (SRS), adds ARC and doesn't change the message.

The bounce looks like this
550-5.7.26 Unauthenticated email from example.com is not accepted due to domain's DMARC policy. …
550-5.7.26 The MAIL FROM domain [example.com] has an SPF record with a hard fail policy (-all) …
554 5.7.9 Message not accepted for policy reasons. See https://postmaster.yahooinc.com/error-codes
554 5.7.1 [BS01] Message rejected due to local policy. Please visit https://support.apple.com/…

What it means

SPF checks the server that delivers the message. After a forward that is the forwarding server, which isn't in the original sender's SPF record, so SPF fails. Google says forwarded messages often fail SPF and aren't automatically trusted because they passed before. DMARC can then pass only through the original DKIM signature, and that breaks when the forwarder changes the message (footer, subject tag, re-encoding) or when the sender never signed with its own domain. If the sender's domain has p=reject, Gmail, Yahoo and iCloud reject the forwarded copy. If you forward from Gmail, the failure comes back as a “Message blocked” notice with the other server's error under the technical details. Google, Yahoo and Apple all point forwarders to ARC, which carries the original authentication results along. Apple doesn't publish what [BS01] means: it is a “local policy” rejection that can also hit mail that was never forwarded.

How to fix it

  1. If you own the sending domain: make every service sign with DKIM for your own domain, because DKIM is what survives a forward. Check it below and look for DKIM: PASS with your domain in Gmail's “Show original”.
  2. With p=reject, every forward that breaks DKIM bounces. Move to reject only once DKIM passes for all your senders (DMARC generator).
  3. If you run the forwarder (your own server, cPanel, a domain forwarder): rewrite the envelope sender to your forwarding domain (SRS), include the forwarding servers in your SPF, and add ARC headers if your mail software supports it.
  4. Don't change forwarded messages: footers, subject tags and re-encoding break the original DKIM signature.
  5. Filter spam before you forward, and don't forward the spam folder. Gmail blocks forwarded spam and counts it against the forwarding domain.
  6. If you just forward a mailbox to Gmail, Yahoo or iCloud: use a forwarder that rewrites the sender (SRS), such as Cloudflare Email Routing, or add the account to the Gmail app over IMAP instead, as Google suggests now that Gmail's POP import is ending (January 2027 for existing users).
  7. iCloud [BS01] that keeps happening: email icloudadmin@apple.com with your company name, domain, sending IPs, the full SMTP error and when it started.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Other bounce errors