Skip to main content
Sign in
Deutsch Español Français Italiano

Google Workspace internal forwarding limitation

Problem

When in Google Workspace there are routing rules to forward emails to another mailbox within the same domain, Google delivers the message through the Email Security Gateway (ESG) without applying SRS (Sender Rewriting Scheme). This can cause the message to be rejected by ESG due to SPF or related authentication failures.

This behavior is a limitation of Google Workspace

Solution

Affected Scenario (NOT SUPPORTED)

Google Workspace does not apply SRS when routing to a final mailbox with this configuration:

-> Google Workspace (admin.google.com)
-> Apps
-> Gmail
-> Routing (NOT "Default Routing")
-> Email forwarding using recipient address map
-> Internal Forward Rule from original user to User Forward To
-> ESG (no SRS applied)
-> SPF / authentication failure
OR you can have this kind of configuration shown below use the "ROUTING" option (the outcome is the same, changes only the way you created the rule)

Recommended workaround (SUPPORTED)

Configure routing rules to deliver messages to a Google Workspace Group, with the intended recipients added as group members. In this case, Google correctly applies SRS.

  1. Create the new group with the intended recipients inside Google Workspace (admin.google.com) > Directory > Groups

        2. When clicking on "NEXT" make sure to selected the External "POST" permission

3. Then, modify the forward rule

-> Google Workspace
-> Apps
-> Gmail
-> Routing (NOT "Default Routing")
-> Email forwarding using recipient address map
-> Internal Forward Rule from original user to GROUP
-> Group members
-> ESG (SRS applied) ->  SPF / authentication passes

Related articles