Fixing SPF Fail when forwarding custom domain email to Gmail

How to Fix Email Forwarding Failures Using SRS

Note: This is a complex technical procedure. Do not attempt this unless you know exactly what this stuff all is and what you are doing! Proceed at your own risk.

For a simplified Markdown version of this guide, check out my GitHub Gist. 

As of January 2026, Google has retired the "Check mail from other accounts" POP3 feature for Gmail. This means the service no longer supports pulling emails from external providers via POP3. Moving forward, setting up email forwarding is the primary way to manage a custom domain through the Gmail web interface.

Note: This guide assumes you already have your DKIM and DMARC records properly configured for your domain.

GOAL: For custom domain names, email forwarding must use SRS (Sender Rewrite Scheme) so that SPF checks do not fail. This is critical when using your own domain, such as fred@mycustomdomain.com, with Gmail.

SOLUTION: Use a Domain Host or DNS Host that supports SRS to forward your emails to Gmail. This fixes the SPF "breakage" that occurs during standard forwarding. Note that you will continue to SEND emails through your current outbound SMTP server.

---

GENERAL STEPS

1. Create a backup configuration of your DNS records. Export these from your current provider's portal. Ensure you capture every record, including "internal" or hidden records used for specialized services.
2. Move DNS Hosting to Cloudflare. Update your nameservers at your registrar to point to Cloudflare's servers.
3. Fix anything that might break during the DNS move. Identify services like domain forwarding or existing email forwarding that your previous DNS host was providing and replicate them in the Cloudflare dashboard.
4. Move Domain Registry to Cloudflare (Optional). While not strictly required, it is easiest to have the host and registry be the same.
5. Wait 24 hours for propagation. Check that your DNS host has properly updated globally. Confirm that all services from Step 3 are stable.
6. Set up Email Routing at Cloudflare. Configure "Email Routing" for each address you want to forward to Gmail. Cloudflare will automatically suggest the necessary records. Crucial: If you already have an SPF record for your existing mail server, do not let Cloudflare overwrite it. You must merge the records so that you only have one v=spf1 statement.
7. Fix the SPF records for Inbound and Outbound mail. Your SPF record must authorize the forwarding path, your primary outbound source, and Google's servers as a safety fallback.
   • The Forwarding Path (Inbound): Cloudflare requires include:_spf.mx.cloudflare.net.
   • The Sending Path (Outbound): Authorize your actual outbound source.
     • By Domain: If your host provides one, use their record: include:your-provider.com.
     • By IP Address: If your host does not provide a domain include, list the server IPs using the ip4 prefix. If they use a cluster (e.g., mail-node-a.provider.com), list all relevant IPs.
   • The Google Fallback: Including include:_spf.google.com ensures that emails sent from the Gmail mobile app or during an SMTP failover are also authorized.
   • Example merged record with multiple IPs:
     v=spf1 include:_spf.mx.cloudflare.net ip4:192.0.2.1 ip4:192.0.2.2 include:_spf.google.com ~all (YOU MUST CHANGE THESE TO YOUR PROPER ADDRESSES AND SERVERS).

NOTE: If you aren't sure which IPs your host is using, send a test email to a service like Proton Mail or a "mail-tester" site and look at the "Received" headers. It will show the exact IP address of the server that attempted the delivery. If it is different from the one in your SPF record, that is your culprit!

8. Test inbound forwarding. Send emails from various external services (Yahoo, Outlook, etc.) to your forwarded addresses. Check the headers in Gmail to ensure SPF, DKIM, and DMARC all report a "PASS."
9. Test outbound sending. Send outbound emails from your custom domain and verify they are received by outside accounts. Since you have not changed the outbound SMTP path, these should remain functional.

---

References and Resources

• Google Support: Upcoming changes to Gmailify and POP in Gmail
• Cloudflare Documentation: How Email Routing and SRS work
• Wikipedia: Conceptual Overview of the Sender Rewriting Scheme

---

 

A Note on the "Google Security Hole"

One thing to watch out for: adding include:_spf.google.com is a broad move. It technically authorizes any Google-hosted account to send mail as your domain. If you are running a strict DMARC policy like p=reject, you do not want to rely on that broad SPF permission alone.

The real fix is ensuring your DKIM alignment is bulletproof at your SMTP host. Since my host signs every outgoing email with a unique cryptographic key, that signature is what actually proves the mail is from me and not just "some guy on a Gmail account." If your DKIM signature is solid and matches your domain, that broad Google SPF include becomes a lot less of a security risk and more of a functional fallback for mobile apps.

Quick tip on monitoring: Add an rua tag to your DMARC record (the Cloudflare dashboard toggle is the easiest way). It provides the reports you need to ensure your p=reject policy is not nuking your own mail by mistake.

I used this domain health checker to verify my alignment and catch a few other syntax errors: suped.com/tools/domain-health-checker. It is a fast, no-fluff tool that shows you exactly where your authentication trio (SPF, DKIM, and DMARC) is succeeding or failing.

How to Protect Cables from Kittens and Cats

 

The thinner the cable, the more attractive it is to these beasts! This means cell phone charging cables and fiber optic cables are some of the most attractive to your kitten or cat.

I warn visitors that our kittens WILL bite through their charger cords if they leave them where they can get to them. And still, they get chomped. The first cable I will replace... the second, they have to buy their own!

So what do you do about this? The BEST solution is called split loom.

Split loom is a flexible plastic tube that is split along its length. It is used to gather and protect wires.

Note that split loom CAN be punctured by kitten teeth, but it is really hard to bite through. The best way to use it is to choose a size that is large enough to leave extra room around your cable. That way, the kitten may be able to puncture the split loom, but since the cable inside can move out of the way, the cable is not punctured or cut.

Installing the split loom can be troublesome. You need to be careful not to damage soft cables while putting them into the relatively sharp-edged split loom. They do sell tools for larger split loom to help put it on long cables. Look here for some tips on YouTube.

I've found that when kittens are young, I need to protect EVERY cable they can access. However, in my experience, older cats will usually ignore heavier cables like power cords, but your cats may be different. Power cords can be especially dangerous to a chomping cat, so be careful!

Below you can see I have protected all the easily accessible cables at my spouses workstation. Note that I have not left any cables dangling on the ground; they are all wound up and attached out of the way under the desk.

Behind the monitor:

Here is the back of the hubs:

Under the desk:

It seems like a lot of work, but if you do it well, you only have to do it once. After the cables are protected like this, we also also mist the cats with water if we see them looking to bite the cables. (But don't mist the cables or electronics!) They learn pretty quickly because the wrapped cables just aren't that attractive to bite anyway.

Just remember, your kitties are worth the effort!

Eye Charts - Landolt C

  

My eye doctor gave me a new contact lens to compare to my old prescription. So I decided I wanted a good eye chart to compare the new lenses.

A bit of research led me to believe the Landolt C eye chart would be the best for me. 

From Wikipedia:

The Landolt C consists of a ring that has a gap, thus looking similar to the letter C. The gap can be at various positions (usually left, right, bottom, top and the 45° positions in between) and the task of the tested person is to decide on which side the gap is. The size of the C and its gap are reduced until the subject makes a specified rate of errors. The minimum perceivable angle of the gap is taken as measure of the visual acuity. It is generally practiced in the laboratory.

The stroke width is 1⁄5 of the diameter, and the gap width is the same. This is identical to the letter C from a Snellen chart. The Landolt C is the standard optotype for acuity measurement in most European countries. It was standardized, together with measurement procedures, by the German DIN, as DIN 58220 (now EN ISO 8596).

Unfortunately, I couldn't easily find one of these sized for viewing at 10 feet. So I made one!

I can't guarantee this is made correctly, but I think it is right.

pdf file download