Comment by AceJohnny2 | Hacker News Reader

Comment by AceJohnny2 | Hacker News Reader

Offtopic, but have people had any success maintaining a personal email domain as forwarding to the major email providers?

I have a vanity domain, and used to be able to use GMail to send email as that domain [1], and forward received mail from that domain back to GMail.

But with SPF, DKIM, and DMARC (or something), this has broken and such received email gets marked as spam and/or phishing.

I don't know how to fix the forwarding/receiving flow [2], because GMail will see the message coming from an arbitrary source, but being forwarded by an intermediate (my hosting provider's forwarding email server) which will fail its integrity checks.

I have not been able to understand how to solve this. Clearly, forwarding servers aren't a well-regarded use-case in this new era of verified email flow.

Also, I'm not just talking about GMail. I used to do forwarding for my family who used a variety of providers, so I can't just switch to GMail (via Google Domains) for my entire domain.

[1] GMail still offers that feature, under Settings->Accounts and Import->"Send mail as"

[2] the sending flow is easy: just add gmail's SPF to my own domain's

You can't forward email to Gmail - they'll blame your server for forwarded spam regardless of everything else being correctly set up. This is true to an extent for other providers, too.

The simplest solution is to set up IMAP on your mail server and have remote mail accounts fetch from it. Most email providers can be configured to fetch via IMAP.

^^^ This ^^^

The problem is that there is no such thing as mail forwarding. It is mail re-sending. So, you get a piece of spam and re-send it to Google, and the From address isn't the spammer, it's you. They'll eventually block the email address, and then the whole domain it's on.

Don't forward. SMTP. SMTP is authenticated, which solves the issue.

There is such a thing as mail forwarding - it just doesn't work with SPF. In fact, since submission and outbound connections are both SMTP pretty much all mail servers to happily forward mail from your client to another server - only with domain and authentication restrictions, but those are not required by the protocol.

ARC is what you need, it a similar signing as DKIM, but resigns a message.

https://en.m.wikipedia.org/wiki/Authenticated_Received_Chain

Interesting. I see a gotcha though:

> Validating an ARC chain only makes sense if the receiver trusts the ARC signers. In fact, an ARC chain can be counterfeited,[3] so ARC processing applies when receivers trust the good faith of ARC signers, but not so much their filtering practices.

Is there any documentation on how GMail and Hotmail onboard a ARC-using domain? Their documentation is very... sparse.

The same way they're gathering intel on domain/IP trustworthyness.

I used to use forwardemail.net for this and recently switched to cloudflare since I already use it for dns and domain registration. Seems to work fine. I use the same flow as you for outgoing mail in gmail

I'm a happy user of ImprovMX.com - used it for free for a long time, now paying some 30$/year. Delivery is pretty much instantaneous, and I had only very few mails not being delivered (and there was a legitimate issue on the sender side, so ImprovMX was rejecting it).

But I'm not really satisfied with the sending side of things - my plan doesn't include the feature, and sending via Gmail is enough most of the time, but setting up each alias manually in Gmail is quite annoying.

I have for many years BUT you have to pay Google to make it work. It used to be free but I guess it was abused too much for spam. Now you have to pay for Google workspace and it should work.

Is there a reason that forwarding is the path chosen for this rather than setting gmail as your MX?

Yes: The "customers" (my family) don't all use gmail.

Reply on news.ycombinator.com