SRS email forwarding: keep SPF and DMARC on a forward

Why a naive forward fails SPF

SPF works by listing, in DNS, the servers allowed to send mail for a domain. The receiving server looks at the envelope sender (the return-path), finds that domain's SPF record, and checks whether the connecting server is authorised. When you forward mail, your server relays a message that still carries the original sender's domain in the envelope. The recipient checks SPF for that domain, does not find your forwarding server in it, and returns an SPF failure - which, under a strict DMARC policy, can send the message to spam or bounce it.

What SRS actually does

Sender Rewriting Scheme fixes the envelope, not the content. On the forward, the forwarder rewrites the MAIL FROM to an address at a domain it controls, encoding the original sender inside that address so bounces can be routed back. Now the receiving server checks SPF against the forwarder's domain, which is authorised, so SPF passes. The visible From header - what the recipient sees - is left unchanged, so the message still reads as being from the original sender.

# Create a catch-all Route that forwards with SRS
curl https://threadcamp.vercel.app/v1/routes \
  -H "Authorization: Bearer sk_live_..." \
  -d '{
    "match": "*@acme-agents.email",
    "action": "forward",
    "destination": "team@acme.com"
  }'

# ThreadCamp rewrites the envelope sender on the forward, e.g.
# MAIL FROM: <customer@example.com>            (original)
# becomes    <srs0=hash=example.com=customer@bounces.in.threadcamp.com>
# so SPF is checked against a domain ThreadCamp is authorised for -> pass

DKIM survives, so DMARC stays aligned

DMARC passes when either SPF or DKIM passes and is aligned with the From domain. DKIM signs the headers and body, which a clean forward does not alter, so a valid DKIM signature travels with the message. Combine an intact DKIM signature with SPF passing via SRS and DMARC stays aligned end to end. The failure mode to avoid is a forwarder that rewrites or appends to the body, which breaks DKIM; ThreadCamp forwards the message intact.

Applied on every Route

ThreadCamp applies SRS automatically on every forward Route - catch-all or alias, to an external address, a webhook, or another inbox - so you do not configure it per domain. Define the Route once via POST /v1/routes and forwarded mail keeps passing SPF and DMARC at the destination, across unlimited domains.