Every forward gets an ARC seal and a rewritten sender

Mailyoto adds an ARC seal to every forwarded email. It doesn’t use SRS, but it rewrites the envelope sender for the same reason.

The problem both solve#

A forwarded email arrives at the destination from Mailyoto’s servers, not from the original sender’s.

• SPF fails, because Mailyoto’s servers aren’t in the sender’s SPF record.
• DMARC can then fail too, and a strict destination refuses the email or moves it to spam.

ARC: a record of the checks before forwarding#

ARC (Authenticated Received Chain) lets each server that handles an email record the authentication results it saw, and sign that record.

Mailyoto seals every forwarded email with ARC, signed as yotosend.com. The destination can read the SPF, DKIM and DMARC results Mailyoto saw when the email arrived, even though SPF fails at the destination.

SRS and what Mailyoto does instead#

SRS (Sender Rewriting Scheme) rewrites the envelope sender, also called the Return-Path, into an address at the forwarder’s domain. SPF is then checked against the forwarder.

Mailyoto rewrites the envelope sender too, without the SRS format:

• When your domain has a Mailyoto MX record and a single SPF record whose include:spf.mailyoto.com passes, with no -, ~ or ? in front of it, the envelope sender becomes an rp+… address on your own domain.
• Otherwise, it becomes an rp+… address on bounces.yotosend.com.

Either way, SPF passes, because both domains authorise Mailyoto’s servers. Bounces come back to Mailyoto, which passes them on to the original sender.

The envelope sender is separate from the From address the reader sees.

DKIM on forwarded email#

Mailyoto adds its own DKIM signature, as yotosend.com, to about 70% of forwarded email, and to every forward whose From address it rewrites. Forwarded email without DKIM explains why some forwards carry only the sender’s signature.