Generated by AI | 2nd Oct 2026

✉️ How your email actually gets delivered

Follow one email from alice@example.com to me@maheshbansod.com.

1. The sender starts the journey

The sender's mail server sees To: me@maheshbansod.com. It asks DNS which mail servers are responsible for maheshbansod.com, then opens an SMTP connection to one of them.

RCPT TO: <me@maheshbansod.com>
DATA
Subject: hello 👋

What DNS is doing

A/AAAA records are mainly about reaching your website. MX records are specifically for email: they answer: “Which servers accept mail for this domain?”

A / AAAA → web MX → email
📍 Routing
MX records tell the Internet where mail for @maheshbansod.com should go.
🔁 Forwarding
Cloudflare can maintain a rule like “me → your Gmail address”.
🔐 Trust
Gmail can evaluate SPF, DKIM and DMARC instead of simply trusting Cloudflare.

🔐 How Gmail trusts a message it got from Cloudflare

The awkward part: the message arrives from Cloudflare, but claims to be from me@maheshbansod.com. Taken at face value that is textbook spoofing, and it would go straight to spam. Three separate mechanisms keep it out of the bin.

1

SPF checks the envelope, not the From

At the last hop, SPF asks one question: is the envelope sender allowed to send? Cloudflare forwards as its own envelope sender and its SPF record permits that, so the hop passes. SPF never looks at the visible From: — it only ever validates the envelope of that single hop.

2

The original DKIM signature survives

Cloudflare forwards the message without re-encoding the body, so the sender's original DKIM-Signature still verifies. That is the whole point of signing a hash of the body: any change to a single byte breaks it.

3

DMARC aligns through DKIM

DMARC passes if either SPF or DKIM lines up with the From: domain. Here the DKIM d= is maheshbansod.com and that is also the visible from domain — so alignment holds. SPF's opinion no longer matters; DMARC only needs one aligned pass.

4

ARC carries the original verdict forward

ARC (RFC 8617) is the bit that makes forwarding viable. Cloudflare stamps ARC-Authentication-Results (the original sender passed), signs those claims in ARC-Message-Signature, and locks the set with ARC-Seal. Gmail evaluates the ARC set of the last forwarding agent and inherits that verdict instead of judging Cloudflare on its own.

Why SPF alone would not be enough. If SPF was the only aligned check, this mail would fail: the envelope sender is Cloudflare, and Cloudflare is (correctly) not authorised to send as maheshbansod.com. The aligned signal has to come from DKIM — which is also why a forwarding setup is much safer than one that rewrites the body.
What quietly breaks it. Anything that mutates the message after signing — a “sent from my iPhone” footer, re-encoding, some antivirus scanners, subject-line rewriting — invalidates DKIM, and with it the aligned DMARC pass. Gmail then has no good reason to believe the message, so forwarding rules should stay as transparent as possible.
See it for yourself in Gmail

Open the message → More (⋮) → Show details. You should see mailed-by Cloudflare, signed-by your mail domain, and a line like SPF, DKIM, DMARC: pass with the signed domain matching the from address. That combination is the whole mechanism above, visible in one panel.

Click a stage to inspect it.
🏢
"Would I rather be feared or loved? Easy. Both. I want people to be afraid of how much they love me."

— Michael Scott