gateway outbound mailchannels
Question asked by Sabatino - 10/16/2026 at 12:29 AM
Unanswered
Does anyone here use or have you tried

I’m curious to know if it works well.
Sabatino Traini
      Chief Information Officer
Genial s.r.l. 
Martinsicuro - Italy

Douglas Foster Replied
A while back, I did an audit of broken ARC chains.    In each case, the chain was broken because a middleman made innocuous and probably inadvertent changes while adding an additional signature.   I contacted every organization that had this problem.   Only Mailchannels responded the way I hoped.  They appreciated the feedback, quickly undertook development effort to investigate the problem, and communicated to me when the fix was deployed.   So it left a very good impression.

By comparison, one vendor said they would not care until their customers complained.   One vendor said they would investigate "next year" when they were planning to implement ARC-interpretation logic.   I don't think any other vendors even bothered to reply.

As an aside, IETF is in the process of declaring ARC a failure.  Yahoo has gone on record with them that ARC is so unreliable and sometimes misleading that it has made accurate filtering harder rather than easier.      
Sabatino Replied

Thanks Douglas, that’s really useful feedback. A vendor that actually listens and fixes things is exactly what I’m looking for.

To give some context on why I’m asking: honestly, I’m tired of playing whack-a-mole with my IP reputation. Some of my users set up forwards, and some addresses are aliases that redirect to external mailboxes (Gmail, Outlook, etc.). I can’t disable forwarding for users, but more than once this forwarded traffic, spam included, has hurt my IP reputation.

So my idea is to use SmarterMail’s routing rules to send only the forwarded traffic through MailChannels, while normal outbound mail keeps going out directly from my server.

I’ve been watching this condition for a while:

  • Condition type: Delivery
  • Field: Is Being Forwarded = true

and it seems to match exactly what I need.

Has anyone already done something similar? I’m especially interested in:

  • whether SRS is needed or recommended in this setup, so SPF doesn’t fail on the original sender’s domain
  • how MailChannels Domain Lockdown behaves with forwarded messages, where the sender domain isn’t one I host
  • any experience with DKIM/ARC surviving the relay

Any feedback is welcome.

Sabatino Traini
      Chief Information Officer
Genial s.r.l. 
Martinsicuro - Italy

Douglas Foster Replied
Opinions:
- Enable SRS encoding of forwarded messages, so that the source and the relay are identified.
- Include the new vendor's SPF in your SPF record, so your part of the SRS encoding is verified.
- Ensure that the outbound message also has your domain's DKIM signature, so that you can be verified even if there is secondary forwarding.
- Ensure that your server has the same name for HELO and Reverse DNS.  Configure forward DNS on the A name and SWIP on the Reverse DNS name so that everything verifies.  I assume this was done a long time ago.
- Verify that the new vendor also ensures that HELO and Reverse DNS match and verify.
- Continue the infinite process of purging unwanted messages from your inbound stream.

I don't think you can do anything more.

Reply to Thread

Enter the verification text