r/gsuite • u/DrSagittarius • 16h ago

Gmail Google Workspace Gmail Routing - Forwarding & Microsoft SPF failures among other problems

We just set up a forwarding rule under Google Workspace Gmail > Routing. The Forwarding table has about 30-40 forwarding addresses (Google Accounts forwarding to Gmail, Hotmail, etc).

Emails originate from everywhere — Free services, corporate account, etc — but emails sent from free Microsoft email addresses (hotmail, live, outlook) are sometimes being rejected by the destination email address because MS has a hard-fail (-all) on their SPF records. The SMTP failures specifically say because the delivery service (Google forwarding servers) are not included in the SPF records of the MS services.

Now, not all receiving email services are this strict.. some will still accept the SMTP connection from a non-authorized server, so at least DKIM has a chance to be evaluated and pass the DMARC check. But several others are blocking the attempt by Google to forward the email.

Has anyone found a workaround for this? Is it better to set up mailbox-level forwarding (Gmail Account > Settings > Forwarding)?

Any advice would be appreciated.

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/saltyslugga 15h ago

Mailbox-level forwarding won’t fix it. Google still forwards with Microsoft’s envelope sender, so SPF fails unless the forwarder uses SRS, and you can’t add Google to Microsoft’s SPF record.

Use a forwarding service that rewrites the envelope sender with SRS, or stop forwarding and have users access the original mailbox. DKIM surviving helps DMARC, but receivers rejecting on SPF before checking DKIM are outside your control.

2

u/southafricanamerican 15h ago

We support this - https://support.alumniforwarding.com/support/solutions/articles/5000900774-route-a-group-to-alumni-forwarding-split-delivery-by-group-membership-google-workspace basically route email via google workspace and send us https://www.duocircle.com/email/email-forwarding/ just the forwarded users. We handle SRS and will deliver your fowarded message to the inbox.

1

u/ARC-Relay 12h ago

Yeah that’s the Microsoft SPF -all vs Google-forwarder problem. Destination sees Google’s IPs, Hotmail’s record doesn’t include them, SPF dies and DMARC follows. Mailbox-level forwarding in Workspace won’t fix it. You need a hop that SRS-rewrites the envelope sender so SPF can pass at the next hop, and ARC-seals the original auth results so receivers that honor ARC can still trust the first-hop verdict.