Email forwarding versus a real mailbox, and when forwarding breaks

Almost every registrar offers free email forwarding. Point contact@yourbusiness.com at the Gmail address you already read, and mail arrives. No mailbox to pay for, nothing to configure, done in a minute.

For some situations that is genuinely the right answer. For a business that replies to customers, it has three specific problems, and the first one is the one everybody hits.

Problem one: you cannot reply from the address

Forwarding is one-directional. It is a redirect rule, not an account. There is no mailbox behind contact@yourbusiness.com, no password, and nothing to connect a mail client to — so when you reply, the message goes out from your personal Gmail, with your personal address in the From line.

The customer wrote to the business and got a reply from dave.m.1987@gmail.com. Every subsequent message in that thread goes to the personal address, outside whatever the business is supposed to be, and unavailable to anybody else who might need to pick it up.

Gmail's Send mail as feature exists to patch this, and it works, but it is not free of the problem. It needs an SMTP server to send through, which means you need credentials somewhere — and if you had somewhere to send from, you had a mailbox.

Problem two: forwarding breaks SPF for the sender

This one is invisible until it is not. When a message is forwarded, the forwarding server relays it onward while keeping the original sender in the From header. The receiving server then checks SPF — and SPF authorises the original sender's domain against the IP that delivered the message, which is now your forwarder rather than the sender's own mail server.

SPF fails. Not for your domain: for the domain of the person who wrote to you. If their DMARC policy is p=reject, Gmail may discard a legitimate message from a legitimate customer, and neither of you will know why.

SRS — Sender Rewriting Scheme — exists to fix exactly this, by rewriting the envelope sender to the forwarder's own domain so SPF passes. Good forwarding services implement it. Free registrar forwarding frequently does not, and nowhere says so.

DKIM usually survives forwarding, since it signs the message rather than the path, which is why a forwarded message often passes DMARC on DKIM alone. That is a fallback rather than a design, and it stops working the moment a forwarder modifies the message — appending a footer, rewriting a link, rebuilding the MIME structure.

Problem three: the reputation is not yours to manage

A forwarder relays whatever arrives, spam included. From Google's point of view, your forwarding server is a machine sending a stream of mail into Gmail, some meaningful proportion of which is junk your domain accepted and passed along.

Forwarders get rate-limited and occasionally blocked for this, and when it happens the mail that stops is yours. You have no access to the logs, no control over the filtering, and no relationship with the provider doing the blocking.

When forwarding is the right answer

None of the above makes forwarding wrong. It makes it wrong for the address a customer replies to. Forwarding is a good fit for:

• Aliases onto a real mailbox you own. invoices@, hello@ and info@ all landing in one mailbox on the same domain, where the reply goes out properly from the main address.
• Addresses that only ever receive. noreply@, or an address printed somewhere you cannot change.
• A domain you are holding but not using yet, so the occasional message is not lost.
• Catching a legacy address after a move, pointed at the new mailbox. Moving your email to a new provider covers the rest of that transition.

The distinction is whether anyone needs to reply as the address. If they do, it needs to be a mailbox.

What a mailbox gives you that forwarding cannot

• Replies from the right address, so the thread stays with the business.
• DKIM signing on outbound mail from your own domain, which is what lets you enforce DMARC at all. Forwarding alone gives you nothing to authenticate. Moving DMARC from p=none to p=quarantine is impossible without it.
• Mail that stays somewhere when the person who reads it leaves, is ill, or loses their phone.
• Shared access, so two people can cover one address without sharing one personal account.
• Logs, when somebody insists they emailed you and you need to know whether that is true.

The arrangement most small businesses actually want

One real mailbox on the domain, with every other address as an alias forwarding into it:

This costs one mailbox. Everything arrives in one place, replies go out from contact@ properly signed, and adding bookings@ next year is a one-line change rather than another subscription.

What to avoid is the catch-all — accepting mail to every conceivable address at the domain. It guarantees that every spammer guessing admin@, sales@ and office@ gets through, and because you accepted the message you cannot later claim you do not use that address.