Email Forwarding Not Working: The Step-by-Step Debug Checklist (Fast Triage)

 

Email forwarding fails because modern security protocols (SPF, DKIM, DMARC) are designed to stop it. To a receiving server, a forwarded email looks identical to a spoofed email: a server that isn't the original sender is attempting to deliver mail on their behalf.

When forwarding breaks, you rarely get a clear error. You get silence.

This guide provides a rapid triage workflow to isolate the failure, followed by a forensic checklist to fix the root cause. For a deep dive into the mechanics of SRS and ARC, refer to our core documentation: Email Forwarding: How It Works, How to Set It Up, and How to Fix It When It Breaks (2026).

The 60-Second Triage: Identify the Symptom

Do not guess. Categorize the failure behavior immediately to determine the fix.

Symptom	Behavior	Likely Culprit	Immediate Action
The Bounce (NDR)	Sender receives a 5xx error immediately.	Policy Block or Invalid Address	Read the SMTP code (see Table 2).
The Silent Drop	Sender gets nothing. Receiver gets nothing.	DMARC Alignment Failure	Check Destination Spam Folder & Headers.
The Loop	Sender gets "Hop count exceeded" or multiple copies.	Circular Rules	Check for "A → B → A" logic.
The Delay	Email arrives hours late.	Greylisting or Throttling	Check Server Logs for status=deferred.

---

The Master Debug Checklist (In Order of Probability)

1. Check the Destination Spam Folder (Silent Drop)

Probability: High
Symptom: No email, no bounce.

Forwarding breaks the "chain of custody." If you forward mail from client@gmail.com to you@outlook.com, Outlook sees the email coming from your server IP, not Gmail's. Since your server isn't authorized in Gmail's SPF record, Outlook treats it as a spoof.

• Action: Log into the final destination mailbox. Check the Junk/Spam folder.
• Fix: If found, mark as "Not Junk." To prevent recurrence, the forwarding server must implement SRS (Sender Rewriting Scheme). Without SRS, forwarding to Gmail, Yahoo, or Outlook is functionally broken.

2. Analyze the Bounce Message (NDR Codes)

Probability: High
Symptom: Sender receives a "Undeliverable" message.

The SMTP error code is the truth. Look for these specific strings in the bounce body:

Error Code	Meaning	The Fix
550 5.7.520	Access Denied (M365). Microsoft blocks external forwarding by default.	Enable "Automatic Forwarding" in Defender (see Step 4).
550 5.7.26	Unauthenticated Email. Gmail rejected the mail due to SPF/DMARC failure.	Your forwarder is not rewriting the envelope (SRS missing).
5.4.14 / 5.4.6	Routing Loop. The email is bouncing between two servers.	Break the loop (see Step 5).
550 5.1.1	User Unknown. The destination address does not exist.	Check for typos in the target email address.

3. The "New Hop" Problem (SPF & DMARC Alignment)

Probability: Critical (for Gmail/Yahoo destinations)
Symptom: Silent Drop or Rejection.

If the original sender publishes a strict DMARC policy (p=reject), simple forwarding will fail 100% of the time without SRS.

Diagnostic Command (Terminal):
Check the DMARC record of the original sender's domain.

    dig _dmarc.originalsender.com TXT +short

 

• Result: If you see p=reject, the email was blocked because your forwarding server changed the sending IP.
• Fix: Use a forwarding service that supports SRS and ARC (Authenticated Received Chain). Legacy forwarding (client-side rules) cannot handle this.

4. Verify Microsoft 365 Outbound Policies

Probability: Very High (if using Office 365)
Symptom: 5.7.520 NDR.

Microsoft disables external forwarding by default to prevent compromised accounts from acting as spam relays.

The Fix:

1. Log in to Microsoft 365 Defender.
2. Navigate to Email & collaboration > Policies & rules > Threat policies > Anti-spam.
3. Select Anti-spam outbound policy (Default).
4. Click Edit protection settings.
5. Set Automatic forwarding rules to On - Forwarding is enabled.

5. Check for Routing Loops

Probability: Medium
Symptom: 5.4.14 Error or High Server Load.

A loop occurs when Server A forwards to Server B, and Server B forwards back to Server A. This often happens when a "Catch-All" on Domain A forwards to Domain B, but Domain B has a rule forwarding back to a specific user on Domain A.

Header Forensics:
Inspect the headers of a delayed message (if one gets through) for these tags:

• X-Loop
• X-MS-Exchange-Inbox-Rules-Loop
• Delivered-To (appearing multiple times)

Fix: Ensure the destination address is a final mailbox, not another alias or forwarder.

6. Gmail Verification (The "Click the Link" Trap)

Probability: Medium
Symptom: Forwarding rule exists but is "Inactive."

If you are forwarding from a personal Gmail account, Google requires destination ownership verification.

• Action: Log into the destination inbox. Find the "Gmail Forwarding Confirmation" email.
• Fix: Click the link. The rule remains dormant until verified.

---

Advanced Forensics: Reading the Headers

If the email arrives but lands in spam, you must prove why. Inspect the Authentication-Results header.

How to view headers:

• Gmail: Open email > Three dots > "Show original".
• Outlook: File > Properties > Internet headers.

What to look for:

    Authentication-Results: mx.google.com;

       dkim=pass header.i=@sender.com;

       spf=pass (google.com: domain of SRS0=ABCD=XY=sender.com=alice@forwarder.com designates 1.2.3.4 as permitted sender)

 

1. spf=pass vs spf=fail: If SPF failed, your forwarding server did not rewrite the envelope.
2. SRS0 in the return path: In the example above, SRS0=... confirms SRS is active. If you do not see this prefix in the Return-Path or spf details, your forwarding setup is obsolete.

---

The "Easy Button": Stop Fighting DNS

Troubleshooting forwarding rules, debugging SPF failures, and fighting Microsoft's spam policies is non-revenue generating work. If you are managing email for a business, you should not be manually rewriting envelope headers.

TrekMail solves this architecturally.

• For SMBs: TrekMail handles the routing logic automatically. You define the route (info@yourdomain.com → you@gmail.com), and our infrastructure applies SRS to ensure delivery.
• For Agencies: Instead of logging into 50 different M365 tenants to enable outbound forwarding policies, TrekMail lets you apply forwarding templates to all your client domains instantly via our dashboard.

Stop fighting the protocol.
Try TrekMail for free and get professional email routing that actually delivers.