How do Email forwarding addresses (a.k.a. aliases) work?

Question

I've been arguing with my registrar and host (1and1.com) about an odd problem with an email forwarding address, and I can't get any further until I know how they work.

What I know is that:

1. mydomain.com has an MX record listing mx00.1and1.com
2. I can configure someone@mydomain.com to forward to one or more other email addresses, without creating a mailbox at 1and1.com for someone@mydomain.com.

There is a peculiar problem involving email from a particular outside sender never reaching the end mailboxes when sent through one forwarding address, and also not bouncing or rejecting to the sender. (But they do reach the end mailboxes when sent directly, without going through the forwarding address configured at 1and1.com.)

1and1.com claims that because a pure forwarding address has no mailbox they have "nothing to do" with the delivery failure. The last tech I spoke to even said that the domain's MX record has nothing to do with delivery if 1and1.com isn't hosting the mailbox.

I assert that they must have something to do with it, because only 1and1.com knows where I have asked mails to someone@mydomain.com to be directed. But I don't know what I can specifically assert must be occurring during this forwarding process, and hence what logs must exist on 1and1.com servers that could illuminate the (presently silent) delivery failure.

Based on the protocols, is it possible to say how an external mail sender would try to interact with 1and1.com to deliver a message addressed to someone@mydomain.com, when that is a pure forwarding address (a.k.a. "email alias") and mydomain.com lists NS, A, and MX records at 1and1.com?

Answer 1

I have a feeling the particular outsider mail server has a "DMARC REJECT POLICY" and the email account you are forwarding it to honor's DMARC (ie. Gmail, yahoo)

So what happens is that the message fails DMARC Validation and gets rejected and you never receive and while other emails that you do receive, most likely don't have a DMARC Policy enabled.

This article: DMARC Record will tell you a little more about the process and how to set one up.

Here's a graphic of what happens at the mail servers and why you most likely never receive the message.

Answer 2

You can test what is happening on the ingoing side by connecting with telnet and attempting to send a message. This will allow you to seen any messages generated. You will also be able to gather the time, source IP address, and destination address. These three values are critical to examining their mail server logs, which should record all messages transiting through their server.

It helps if you have control of the mail server to which email is being forwarded. That will allow you to verify if there is an attempt to forward the email, or not. Even if they try, there are a number of conditions which may cause delivery issues. It is getting increasingly difficult to avoid spam filtering rules, which a mail forwarder may well trigger.

The SMTP mailing system is based on a store and forward process. This makes it extremely tolerant of server outages. However, it allows almost any server to send email to almost anyone. (Hence, it is easy to use a bot to send spam.) It does recommend configuring your DNS so that rDNS (reverse DNS) validation is valid. Many sites may silently ignore, or file as spam, email that fails rDNS validation.

Given the existing spam avoidance measures, you likely want a remailer with good spam filtering rather than a mail forwarder. When using a mail forwarder, it is best if the target system is aware of the forwarder, and grants it appropriate trust.