Implement SRS (which will fix no-reply@forwardemail.net having to be used as a "Friendly From")
ralphilius opened this issue · comments
Hello,
I wonder if I missed something, but all emails sent to my gmail inbox are only from no-reply@forwardemail.net. I see that that should be a fallback for strict DMARC record policy.
Anyway, great service +1
Thank you,
Yeah, this is happening to me too. Seems like most major email providers employ strict DMARC record policy. Only thing to do is check the Reply-To header for these emails to see who actually sent the mail.
Me too. Reply-To works fine though, so it's just a matter of getting used to. Great service!
Hello. It is possible to prevent this?
No, because we do not implement ARC (yet) and this is the only other option to ensure emails land in the inbox. The "Reply-To" header should be on the emails.
I'm having an issue with this too, at least with Gmail. I'm getting a lot of spam from no-reply@forwardemail.net, and after reporting emails as spam, now many legitimate messages from no-reply@forwardemail.net, such as emails from Amazon, are going straight to spam. I did add no-reply@forwardemail.net to my Contacts in Gmail, but that doesn't seem to be helping.
I've also tried using Mailgun for forwarding, and some of the emails that I was receiving just fine through Mailgun, such as emails from Redbox, for example, are coming through forward-email as no-reply@forwardemail.net.
Edit: Sorry, after doing some more reading I understand why this is necessary. I look forward to the ARC implementation.
Thanks @lucaseverett 😄 Will update this thread once it's in!
Would it be possible to enable ARC (and get rid of the Reply-To headers) with selected providers, known to support it (such as Gmail)?
What would it take to get ARC support coded? Once it is coded, there could be a flag in the TXT record to enable it for a specific forward. That way people who use Gmail or another provider that already supports ARC will be able to enable it and enjoy the benefits.
Perhaps there could be a bounty posted to fund the coding?
How about implementing SRS (Sender Rewriting Scheme, #137) as a solution?
Yes, SRS is THE solution. I have it locally done, I am just releasing some other stuff first.
Released as of v6.0.0 and just deployed to all production mail exchange servers. This should go into effect immediately, and you should no longer have no-reply@forwardemail.net nor friendly-from rewrites with a "Reply-To" header being added to your forwarded emails.
As always, thanks for your patience, let me know of any issues, and please consider upgrading to a paid plan or making a donation.
https://forwardemail.net/features
https://forwardemail.net/donate
I'm still getting no-reply@forwardemail.net as some from addresses. What could that be from?
I rolled back the deployment until I add more edge case handling.
Should this be reopened until the deployment is rolled out again?
Thanks for the awesome service. Looking forward to the SRS redeployment.
@niftylettuce Any news on the edge cases handling, or a new ETA on the deployment of SRS? Thank you!
Hoping to find more time this weekend, I got nearly all of it done last.
How's it going on SRS? Microsoft Outlook seems to be marking many forwarded emails as Junk, presumably because the From is "no-reply@forwardemail.net". Kind of a deal breaker :(.
Yes, SRS would be much appreciated 👍
Just FYI it does say @ https://forwardemail.net/en/faq#how-do-you-prevent-spammers-and-ensure-good-email-forwarding-reputation that the service uses SRS which does not at the moment seem correct; as with others I look forward to seeing any development, thank you.
Done and deployed. v6.0.1 released.
Done and deployed. v6.0.1 released.
Thanks for the deployment of v6.0.1, but I still received some no-reply@forwardemail.net instead of the sender email.
There is one unavoidable edge case that friendly-from rewrite is required, and that is when DMARC is enforced on the FROM, but when SPF and DKIM is tested, SPF passes alignment but DKIM fails alignment - the rewrite is required here.
I still get no-reply@forwardemail.net in the FROM addresses of emails I forward using one of my domains. The MX/TXT records pass verification with ForwardEmail, and the DMARC records pass verification with Postmark. I have checked that Cloudflare and Google caches are purged. The email headers confirm that DMARC, SPF, and DKIM are all passing. The TO address being forwarded to is a Gmail account, and I've sent using both Gmail and Outlook accounts as FROM addresses.
Can you advise what I might look into to identify the problem? This doesn't seem to be the edge case you mentioned above. I've also been receiving spam I never got before, and I'm unsure if it's related.
Can you forward me an email and show me the FROM and TO, along with the full MAIL FROM envelope?
Yes. I can send you a test email to/from myself, a spam email, and my DMARC report from Postmark, along with their headers, and you can use whatever is useful. How should I send this to you?
Email attachment is fine with me - niftylettuce@gmail.com, thanks!
I have forwarded you the emails (except the spam email; Gmail blocked my first attempt when I tried to attach it). I apologize if this ends up being a simple user error. I tried to study this for about a week before reporting an issue. Note that I'm using Gmail free version, not G Suite. Despite the headers telling me DKIM passed, I don't have a DKIM key in my DNS (I'm guessing that's the problem, but I thought it was possible to get it to work as intended with free Gmail).
Hello everyone, I have just fixed and deployed this issue. The culprit was that our code always rewrote with a friendly-from IF and ONLY IF the domain sending FROM had a DMARC policy. HOWEVER this was not accurate, it should only rewrite with a friendly-from IF and ONLY IF the domain sending FROM had a DMARC policy AND the DMARC policy was "reject". One line of code fixed this, see 13cc0b7#diff-168726dbe96b3ce427e7fedce31bb0bcR954.
If you send test emails FROM yourself and TO yourself then you will get this warning message (which you can ignore and simply click "Looks safe" on).
Don't worry - your recipients won't see this, only you will.
I can confirm that it fixed the problem on my end regarding the no-reply address. Thank you for your efforts. I hope the email data was useful.
That confirmation was premature. I've still been getting no-reply in the FROM but not for all emails, just some emails, with (as far as I know) no change on my end. Everything is fine when I receive an email from my own Gmail or Outlook accounts, as well as from certain senders such as GitHub and some of my services and even some of my spam, but not from some of my other services. Is this the same sort of problem, or is it a different issue entirely because the sender isn't me?
We have to do the friendly-from in order to be DMARC compliant for some senders, that's why it sometimes shows and sometimes doesn't. If we don't abide by DMARC then we would be allowing spoofed emails to go through our system. This occurs to ensure that 100% of the emails will go through, as some providers will completely reject an email if DMARC fails.
So here's how it works...
DMARC authentication pass = (SPF authentication pass AND SPF identifier alignment) OR (DKIM authentication pass AND DKIM identifier alignment)
Both SPF and DKIM tests reference the "From:" address in the message header's "From" value.
Ref: https://dmarc.org/draft-dmarc-base-00-01.html#id_alignment_element
So, behavior as intended. Thank you for clarifying.
You brought up a good point - I know this is extremely complicated stuff and so many edge cases, I might make an infographic or some visual and put it in the FAQ about this when I get time.
Just a heads up to anyone reading this. I've done some updates lately so you won't get that yellow warning message anymore, instead you'll get a one-time email if you send a message to yourself, explaining that the reason it's not showing in the inbox is because it has the same Message-ID, and Gmail only shows this as one email (this is widely known).
See https://forwardemail.net/en/faq#why-am-i-not-receiving-my-test-emails for more insight.
Additionally, there are two major changes I'm releasing most likely within the next 24 hours:
- Since Gmail does not respect SRS, I will be removing SRS sending to Gmail (this will also fix vacation responders sending to the MAIL FROM incorrect address).
- I am implementing the ARC specification
See previous message - additionally, I no longer rewrite the Message-ID, and preserve DKIM headers on pretty much all Gmail messages now, so the % of "friendly from" rewrites has gone down drastically.
ARC has been deployed. No more friendly-from rewrites. No more "no-reply@forwardemail.net". I've also removed SRS, so that Gmail and vacation responders do not have edge case formatting issues.