Package 1 · Backup MX
Secondary MX, temporary queuing during destination outages and automatic delivery on recovery. No mailbox pre-check, AntiSpam, Antivirus, content inspection or quarantine.
TECHNICAL GUIDES
Backup MX, SPF, DKIM and DMARC
Why forwarded email can fail authentication, how sender rewriting helps and where its limits remain.
Package 2 · Email Protection
Primary MX gateway with configurable AntiSpam, Antivirus, sender-domain checks and quarantine. Publish only gate.securawall.com and configure a separate manual receiving target. Queuing and recovery remain included.
Optional SMTP Relay add-on
Add authorized outbound delivery to either Package 1 or 2 for the same domain. Separate add-on pricing, approval, server credentials, quotas, TLS and verified SPF apply. Customer-domain DKIM signing is optional and recommended. Incoming protection remains determined by the base package.
Explore packages and add-ons
By the SecuraWall team · Updated · Operational guidance, not a delivery guarantee.
Forwarding changes the SMTP path
A receiving system sees the gateway as the connecting SMTP peer. SPF evaluates sending authorization for an envelope identity, rather than choosing inbound MX order. Forwarded mail can therefore encounter a different SPF result at the next hop. Changing your protected domain’s SPF does not authorize the gateway for every unrelated original sender.
What sender rewriting changes
SecuraWall uses sender rewriting for the SMTP envelope on eligible forwarded messages. This can support forwarding SPF checks and the return path for delivery failures. It does not replace the visible From address with an aligned identity and does not promise a DMARC pass.
DKIM and alignment
A valid DKIM signature must survive relevant message changes. DMARC requires a successful authentication mechanism whose domain aligns with the visible author domain. A preserved aligned DKIM signature may provide that result even where forwarding changes SPF. Receiver policies still decide how a message is handled.
Diagnose before relaxing policy
Collect the exact receiving response, Authentication-Results, DKIM selector, envelope sender and visible From. Compare a controlled direct message with one through the gateway. Ask the receiving administrator to evaluate the supported connector or inbound gateway configuration. Do not disable spam or authentication checks globally.
What this guide does not guarantee
No inbox placement, trusted ARC relationship or universal cloud-provider compatibility is promised. The free Domain Check reads DNS records, including published SPF text; it does not test a message’s SPF or DMARC result or discover every DKIM selector. Use the receiving service’s diagnostic tools for message-level evidence.
References and service conditions
Related guides
Deferred vs Bounced Email: SMTP 4xx and 5xx
Read delivery errors without confusing temporary retry, permanent rejection and inbox placement.
Read guide →Backup MX with Microsoft 365: Evaluate the Mail Flow
Check whether a secondary SMTP route fits your tenant and what receiving configuration must be validated.
Read guide →Backup MX with Google Workspace: Plan Before Adding MX
Evaluate secondary routing, forwarded-mail authentication and receiving policies without assuming universal compatibility.
Read guide →Email Protection: Primary Gateway Routing
Use the only published MX to place configured protection before your receiving server.
Read guide →