Why are forwarded emails missing DKIM signing?

As of April 10, 2026, ImprovMX no longer adds its own DKIM signature to forwarded email. Previously, forwarded mail was re-signed with improvmx-mails.com; now it's passed through with whatever DKIM signature (if any) the original sender applied. Mail sent through authenticated ImprovMX SMTP is unaffected and still DKIM-signs with your own domain.

Why we stopped

• The signature was signed with improvmx-mails.com, which didn't match the sender's domain, so it never actually aligned for DMARC.
• It caused improvmx-mails.com to accumulate reputation from forwarded spam we didn't originate.
• It was the reason Gmail showed the "via improvmx-mails.com" annotation on forwarded messages.

Why DMARC on forwarded mail is hard

Forwarding always breaks SPF — the Return-Path is SRS-rewritten — so forwarded mail relies entirely on the original sender's DKIM signature surviving the hop. If the sender DKIM-signs their outbound mail, DMARC aligns and the forwarded message delivers cleanly. If they don't, the message may be quarantined at strict receivers. This is true of all forwarding services, not just ImprovMX.

What to check if you see dkim=none

The most common cause is that the original sender isn't DKIM-signing their mail at all. Consumer @outlook.com and @hotmail.com mail in particular is not always signed — Microsoft signs mail submitted through Outlook on the Web or smtp-mail.outlook.com, but mail from connected accounts, third-party SMTP relays, or some legacy account types goes out unsigned.

To confirm: have the original sender send directly to a Gmail address, without ImprovMX in the path. In Gmail, click "Show original" and look at Authentication-Results. dkim=pass header.d=<sender-domain> will be missing there too, which indicates the original sender did not sign with DKIM.

What you can do

• If the sender controls their sending domain, enable DKIM on it. Forwarded mail will then DMARC-align via DKIM.
• If the sender can't be signed, forwarded mail may be quarantined at strict receivers. There's no workaround on our side.

What about ImprovMX SMTP sending?

Unaffected. Outbound mail sent through your SMTP credentials is still DKIM-signed with your domain via the dkimprovmx1._domainkey and dkimprovmx2._domainkey selectors. See Adding DKIM & DMARC records.