MX forwarding explained: can MX records forward email?

“MX forwarding” is a common search, and a slightly misleading idea. MX records play a part in every forwarding setup, but they can’t forward anything on their own. Knowing why makes it much easier to pick the right setup, and to avoid the replies, spam-folder and authentication problems forwarding can cause.

What an MX record actually does

An MX (mail exchanger) record is a line in your domain’s DNS that answers one question: which server accepts email for this domain? When someone sends a message to support@yourdomain.com, their mail server looks up your domain’s MX records, picks the one with the lowest priority number, connects to that host, and delivers the message there (RFC 5321, section 5.1).

That’s all an MX record is: a signpost. It holds a priority and a host name, nothing else. It has no field for “send a copy to this address”, and DNS never handles the message itself.

Why MX records can’t forward email

Forwarding means accepting a message and sending it on somewhere else. That takes a mail server: something that receives the message, decides where it should go, and delivers it again. DNS doesn’t do either, so an MX record can only point at a server that does.

So when a provider offers “MX forwarding”, what it means is: point your MX records at our servers, and our servers will forward the mail for you. The MX record decides who receives the mail. The forwarding happens on whatever server it points to.

A common mistake follows from this. Pointing your MX record at another mailbox’s host, such as Gmail’s servers, doesn’t forward mail to your Gmail address. Those servers only accept mail for addresses they host, so messages for your domain bounce.

The real ways to forward email

1. Your registrar’s email forwarding

Many domain registrars include free forwarding. You switch it on, they set your MX records to their forwarding servers, and you choose where each address goes. It’s the quickest option. It usually only covers receiving, and the feature set depends on the registrar.

2. Cloudflare Email Routing

If your DNS is on Cloudflare, Email Routing forwards mail for your domain to verified addresses, on the free plan. It handles authentication carefully: it rewrites the envelope sender so SPF passes at the destination and adds DKIM signatures, and Cloudflare says its email service supports ARC, which lets the destination see the original authentication results. But Cloudflare is explicit that “Email Routing does not support sending or replying from your Cloudflare domain” (Cloudflare Email Routing: Postmaster).

3. A dedicated forwarding service

Independent forwarding services work the same way as registrar forwarding: their MX records, their servers, your forwarding rules. They often add extras such as more aliases, logs, and sometimes the ability to send as the address. Check how each one handles SPF and DKIM before relying on it.

4. A forwarding rule in an existing mailbox

If the domain already has mailboxes, say in Google Workspace or Microsoft 365, you don’t change MX at all. Mail arrives in the mailbox as usual, and a rule there forwards a copy elsewhere. This is the right choice when the mailbox has to keep working.

5. Point MX at an inbox service, with no forwarding hop

If nothing else needs to receive mail for the domain, the simplest setup is to skip forwarding and point the MX records straight at the service where you want to read and answer the mail. That’s what InboxNest calls Direct MX: the domain’s MX records point at InboxNest, mail arrives in one inbox, and replies go out from the same address. If the domain already has email you need to keep, InboxNest works with forwarding instead (Direct MX or forwarding?).

The trade-offs of forwarding

Replying

Forwarding is one-way. The message reaches your other inbox, but when you hit reply, the answer comes from that inbox’s address, not the one the customer wrote to. Fixing that needs a second piece: a provider that lets you send as the original address. Gmail’s “Send mail as” used to fill that gap, but Google is ending it for third-party addresses in January 2027 (what that means for support@).

SPF

SPF checks whether the server delivering a message is allowed to send for the envelope sender’s domain. When a forwarder passes a message on unchanged, the delivering server is the forwarder, which isn’t on the original sender’s SPF list, so SPF fails. RFC 7208 describes this, and the fix: forwarders that rewrite the envelope sender (“MAIL FROM”) into their own domain (RFC 7208, section 10.3 and Appendix D.2). That rewriting is often called SRS, and good forwarders do it.

DKIM and DMARC

DKIM signatures travel inside the message, so they usually survive forwarding, as long as the forwarder doesn’t change the signed parts. Gmail’s guidance for forwarders is to “Avoid changing the body and message headers protected by DKIM”, and notes that edits such as changing the subject can break the signature (Gmail: best practices for forwarding email to Gmail). Because SPF tends to fail on forwarded mail, DMARC passes only if the original DKIM signature survives and aligns with the sender’s domain.

Deliverability

Your forwarder becomes the server delivering everything your domain receives, spam included, to your inbox provider. Gmail says it “doesn’t automatically authenticate forwarded messages that previously passed authentication”. It also recommends that forwarders filter spam rather than pass it on, because forwarded spam can hurt future delivery. Legitimate mail from a careful forwarder usually arrives fine. A forwarder that passes spam along can drag down everything else it sends you.

Choosing a setup

• You only need to receive a few messages, and replying from a personal address is fine: registrar forwarding or Cloudflare Email Routing.
• The domain already has mailboxes that must keep working: leave MX alone and add a forwarding rule in the mailbox.
• You need to receive and reply as the address: point MX at a service that does both, or keep your MX and forward to one that can send as you.

Whatever you choose, check the result. The MX checker shows where your domain’s mail is delivered, which provider runs those servers, and whether every host resolves. The support email checker adds SPF, DKIM and DMARC, so you can see whether your replies will pass too.