Why forwarded mail lands in spam
Cloudflare Email Routing forwards mail from [email protected] to an inbox. As a forwarder it becomes the sender Gmail sees, so the original domain’s SPF and DKIM results stop matching the delivering server and Gmail defaults to suspicion. Records must be relaxed, not strict.
v=spf1 include:_spf.mx.cloudflare.net ~all
v=DMARC1; p=none; sp=none; aspf=r; adkim=r; rua=mailto:[email protected]
aspf=r and adkim=r stop a forwarded message being penalised for a check it cannot pass. p=none is the starting policy; quarantine or reject comes later, once delivery is stable.
Cloudflare does not DKIM-sign forwarded mail — it did not author it — so the sender’s signature usually fails after forwarding: expected, not a misconfiguration.
Failures are silent
A failed forwarded message produces no non-delivery report; NDRs are not sent back to the original sender. The dashboard counts dropped, forwarded and successful messages — retrospective, not alerting.
Options, by effort:
- check the dashboard’s routing insights periodically, learning about failures late
- route inbound mail to a Worker, not a destination address; the Worker attempts delivery and reports failure — a webhook to Slack or a second inbox
- use a real mail provider where delivery must be guaranteed — forwarding-only services have no bounce handling by design
The third is the honest answer for mail that matters.