After some discussion with the devs, here's what I was told:
Forward Confirmed rDNS (FCrDNS) checks are technically considered legacy by many in the industry. Modern sender validation instead relies on standards such as SPF, DKIM, and DMARC, which provide stronger and more reliable verification.
The older RFC that prohibited using a CNAME in reverse DNS (RFC 1912) is classified as a legacy best practice document, not an active standard. More recent RFCs don’t clearly forbid the use of CNAMEs in rDNS, which is why SmarterMail doesn’t fail those cases outright.
Functionally, SmarterMail still performs the forward-confirm check, but if the reverse entry resolves through a CNAME, it passes as long as the resolution completes successfully.
That said, flagging forward-confirm failures even when CNAMES are present might help catch some spam. The reality, however, is that spammers could avoid this by switching to A/AAAA records.
For now, SmarterMail’s approach is consistent with current RFC guidance and best practices, but we’ll continue evaluating whether additional scoring logic would meaningfully reduce spam without introducing false positives.