Email Forwarding Troubleshooting Tutorial (2026): Fix Broken Forwarders on cPanel/WHM and Postfix

Email forwarding can fail in ways that look like general “mail problems,” even when your queue is healthy. A forwarder can break due to SPF/DMARC policy, a routing loop, a bad MX decision, or a quiet cPanel setting that changes delivery behavior. This email forwarding troubleshooting tutorial shows you how to pinpoint where the message stopped, then fix it on cPanel/WHM or a plain Postfix VPS.

If you host client mail, forwarders attract tickets. The goal here is repeatable diagnosis. Confirm where the message went, why it was rejected, and what change fixes it without hurting deliverability elsewhere.

What you’ll need (and how to avoid breaking production)

• Access: WHM root (or sudo on your VPS), plus the ability to read mail logs.
• Domain control: you can edit DNS (MX, TXT) for the affected domain.
• Safe test mailbox: a Gmail or Outlook mailbox you can forward to for controlled testing.
• Rollback mindset: write down every value you change (MX records, WHM routing, forwarder targets).

If you’re troubleshooting on a server you manage yourself, a HostMyCode VPS gives you the log access you need to solve forwarding issues quickly.

If you’d rather not touch Postfix internals, managed VPS hosting is the cleaner option for production email workloads.

Step 1: Reproduce the forwarding failure with a controlled test

Pick one forwarding address, for example sales@yourdomain.com → yourname@gmail.com. Send a test email from a third-party sender (not the same server), such as a personal Gmail account.

1. Send a message with a unique subject: FWD-TEST-2026-09-02-01.
2. Wait 2–3 minutes.
3. Check the destination inbox and spam folder.
4. If it fails, check for a bounce at the original sender.

Most forwarding failures land in one of these buckets:

• Hard reject: you get an NDR/bounce with a reason (policy, SPF, user unknown).
• Silent drop: it “succeeds” but never arrives (often filtering or misrouting).
• Loop/deferral: repeated delivery attempts, or “too many hops”.

Step 2: Identify where it broke (sender bounce vs server log)

If the sender received a bounce, copy the full SMTP error (not just the summary). The exact string usually points to the root cause.

If there’s no bounce, move to server logs. On cPanel servers, the fastest places to look are:

• WHM: Email → Mail Delivery Reports (search by subject/sender/recipient)
• CLI: /var/log/exim_mainlog (cPanel uses Exim by default)

On Postfix-based VPS mail servers, you’ll typically use:

• /var/log/mail.log (Debian/Ubuntu)
• /var/log/maillog (RHEL/Alma/Rocky)

Helpful log commands:

# Debian/Ubuntu (systemd)
sudo journalctl -u postfix --since "20 min ago" | tail -200

# Traditional mail log grep
sudo grep -i "FWD-TEST-2026-09-02-01" /var/log/mail.log | tail -50
sudo grep -i "to=<sales@" /var/log/mail.log | tail -80

On cPanel/Exim, you can grep for the recipient:

sudo grep -i "<sales@yourdomain.com>" /var/log/exim_mainlog | tail -80

If you need a structured approach to email auth errors (SPF/DKIM/rDNS), keep this nearby: email deliverability troubleshooting.

Step 3: Fix the most common forwarder killer in 2026 — DMARC alignment

Inbox providers are much less forgiving about forwarded mail that breaks authentication. Traditional forwarding changes the delivery path. It does not “fix” SPF or DKIM in a way that preserves DMARC alignment.

If the original domain publishes a strict DMARC policy (p=reject or p=quarantine), the final mailbox may reject the forwarded copy or dump it into spam.

Common signs in bounces or logs:

• DMARC policy reject
• 550 5.7.26 / 5.7.1 policy errors (wording varies by provider)
• Mail lands in spam only when forwarded (direct-to-Gmail works)

Practical fix: enable or add SRS (Sender Rewriting Scheme) on the forwarding server. SRS rewrites the envelope sender so SPF can pass at the final destination. That reduces many DMARC-related rejects.

cPanel/WHM: enable SRS for forwarders

On many cPanel servers, you can enable SRS in WHM. The exact label varies by build. Look for SRS support for forwarded mail.

1. Log in to WHM.
2. Search for SRS in the sidebar search.
3. Enable SRS for forwarded mail (and save).
4. Retest the same forwarder with your unique subject.

If you don’t see SRS in the UI, check your Exim configuration manager options or ask your hosting provider.

If you run business-critical mail on your own VPS, this is also where managed support can save you time.

Postfix VPS: enable SRS with postsrsd

On Ubuntu/Debian, postsrsd is a common SRS daemon.

sudo apt update
sudo apt install -y postsrsd

Edit /etc/default/postsrsd (or /etc/postsrsd.conf depending on distro packaging) and set:

• SRS_DOMAIN=yourdomain.com
• SRS_SECRET=...a-long-random-secret...

Then wire it into Postfix:

sudo postconf -e "sender_canonical_maps = tcp:localhost:10001"
sudo postconf -e "sender_canonical_classes = envelope_sender"

sudo postconf -e "recipient_canonical_maps = tcp:localhost:10002"
sudo postconf -e "recipient_canonical_classes = envelope_recipient"

sudo systemctl enable --now postsrsd
sudo systemctl restart postfix

Retest. If it still fails, move on to routing and loop checks.

Step 4: Check for routing mistakes (Local vs Remote Mail Exchanger)

A common cause of “broken forwarding” is simple mismatch. Your server thinks the domain is local, but DNS sends mail elsewhere (or the reverse). That mismatch can cause “user unknown” errors, deliver mail into the wrong place, or trigger a loop.

cPanel/WHM: verify email routing per domain

1. WHM → Email → Email Routing Configuration.
2. Select the domain.
3. Choose the correct option:
   • Local Mail Exchanger if this server hosts the mailboxes.
   • Remote Mail Exchanger if another provider receives mail for the domain.
4. Save and retest.

Pitfall: If you use cPanel only for web hosting but moved MX to Google Workspace/Microsoft 365, set the domain to Remote.

If you leave it as Local, the server may accept mail it shouldn’t. Forwarders then behave unpredictably.

Postfix VPS: confirm what Postfix considers local

Run:

sudo postconf mydestination
sudo postconf virtual_alias_domains
sudo postconf virtual_mailbox_domains

If your domain appears in mydestination but you don’t host local mailboxes, remove it and reload Postfix.

On many setups, mydestination should stay limited to hostnames like $myhostname, localhost.$mydomain, localhost.

Step 5: Detect and fix forwarding loops (the “too many hops” problem)

Loops happen when two systems forward to each other. They also happen when a forwarder points to an address that routes right back to the same server. Typical errors include:

• mail forwarding loop detected
• too many hops
• Repeated Received headers involving the same hosts

Quick loop checklist:

• Does sales@ forward to an address that forwards back to sales@?
• Do you have both a forwarder and an autoresponder that replies to forwards?
• Did you set a catch-all forwarder to an address hosted on the same domain?

cPanel: inspect forwarders and catch-all behavior

1. cPanel → Email → Forwarders.
2. Check per-address forwarders and Default Address (catch-all).
3. Remove or adjust any forwarder that routes back into the same domain without a terminating mailbox.

Rule of thumb: a catch-all that forwards externally is risky for spam volume. If you care about signal-to-noise, create explicit forwarders for known addresses.

Step 6: Confirm the forwarder isn’t failing because of DNS (MX, SPF, DKIM, and rDNS)

DNS affects forwarding in two places. First, it determines where the original message is delivered. Second, it influences whether the forwarded copy is accepted downstream.

Check MX and basic resolution

dig +short MX yourdomain.com
dig +short A mail.yourdomain.com

If you’re mid-migration, lower TTLs before switching and keep a rollback plan. HostMyCode’s DNS cutover checklist is built for that workflow.

Forwarding + SPF: understand what you can and can’t “fix”

SPF checks the sending server against the envelope sender domain. With basic forwarding, the envelope sender stays the original sender unless you use SRS. That’s why SRS is the fix.

“Adding your forwarder server IP to SPF” for someone else’s domain doesn’t work (and you can’t do it anyway).

DKIM: don’t break good mail while chasing forwarded mail

DKIM usually survives forwarding. It fails when something modifies the message in transit. Common culprits include added footers, rewritten headers, or content scanning that changes the body.

If you intend to forward cleanly, avoid outbound content modification.

If your own domain’s mail is failing authentication, fix that first. Two references that pair well with this tutorial:

• DKIM setup tutorial
• rDNS setup tutorial

Step 7: cPanel-specific checks that break forwarding quietly

cPanel is convenient, but it adds layers. Those layers can reroute or discard messages before the forwarder ever runs.

Check these before you rebuild anything.

• Account-level filters: cPanel → Email → Email Filters. A filter can discard or redirect before the forwarder runs.
• Global filters: WHM → Email → Global Email Filters. Resellers often inherit these and don’t realize they’re active.
• Spam settings: aggressive spam actions can delete messages that would have been forwarded.

Quick diagnostic: disable one suspicious filter, send one test message, then turn the filter back on. Don’t leave protections off any longer than necessary.

Step 8: Postfix-specific forwarder checks (virtual_alias_maps and transport)

On Postfix, forwarding is often done with virtual_alias_maps. One wrong address, a missing file, or an unbuilt map can send mail into a void.

Inspect your alias mapping

sudo postconf virtual_alias_maps
sudo postmap -q sales@yourdomain.com /etc/postfix/virtual

If postmap -q returns nothing, the mapping doesn’t match what Postfix is using. Confirm the exact address and the exact file path.

Example /etc/postfix/virtual:

sales@yourdomain.com    yourname@gmail.com
info@yourdomain.com     yourhelpdesk@outlook.com
@yourdomain.com         catchall@example.net

After changes:

sudo postmap /etc/postfix/virtual
sudo systemctl reload postfix

Watch a single delivery attempt live

Tail the log while sending your test email:

sudo tail -f /var/log/mail.log

Focus on the remote response code. What looks like a “forwarder issue” is often a downstream rejection, not a local Postfix failure.

Step 9: Fix “forwarded mail goes to spam” without disabling protection

Sometimes forwarding works mechanically, but the destination treats the mail as suspicious. These changes usually help without weakening your overall posture:

• SRS (already covered) to reduce SPF/DMARC failures.
• Don’t add disclaimers/footers to forwarded mail (it can break DKIM).
• Prefer redirect-style forwarding where supported, but test carefully.
• For business-critical mail: use proper multi-inbox delivery (IMAP) or a shared mailbox instead of chaining forwarders.

If the real requirement is “send all site emails to Gmail,” you’ll usually get fewer surprises by using authenticated SMTP for your apps and WordPress. See: SMTP relay setup guide.

Step 10: Monitoring and alerts for forwarder failures

Forwarders often fail quietly. That’s why they become “urgent” only after someone misses an email. Add an external signal so you hear about problems first.

• Create a scheduled test that emails forward-test@yourdomain.com daily and checks arrival.
• Alert on bounce keywords: dmarc, policy, spam, too many hops.
• Track mail log volume spikes; they often correlate with spam floods into catch-alls.

If you already run monitoring, add a simple health check endpoint and alerting around mail services. HostMyCode’s uptime monitoring tutorial shows a practical pattern for VPS and dedicated servers.

Forwarding troubleshooting checklist (printable)

• Reproduce with a unique subject and save headers/bounce text.
• Check logs (Exim mainlog on cPanel, mail.log/journalctl on Postfix).
• Enable SRS for forwarded mail if DMARC/SPF is biting.
• Verify routing: Local vs Remote Mail Exchanger (cPanel) or mydestination (Postfix).
• Check for loops: catch-all forwards, circular forwarding, autoresponders.
• Validate DNS: MX correct, SPF/DKIM/rDNS sane for your outbound mail.
• Inspect filters (account + global) and spam actions that discard mail.
• Retest after each change; change one variable at a time.

Summary: the clean fix beats the quick fix

Most forwarding failures in 2026 come down to policy and routing, not a dead mail server. Start with logs. Fix alignment (SRS) next. Then clean up routing and any loops.

This order gets you to the answer faster, and it keeps your spam defenses intact.

If you want forwarding and deliverability to be predictable, run email on infrastructure where you control DNS, logging, and mail configuration. A HostMyCode VPS is ideal for that, and managed VPS hosting helps if you prefer an ops team to handle mail routing and policy safely.

FAQ

Why does email forwarding fail only for Gmail/Outlook destinations?

Those providers enforce authentication and policy more strictly. Forwarding can break SPF/DMARC alignment, causing rejects or spam placement. SRS is usually the practical fix.

Should I “fix” this by adding the forwarding server to SPF?

Only for your own domains. Forwarding other senders’ mail can’t be solved by editing their SPF. Use SRS so the envelope sender becomes a domain you control for forwarding.

How do I know if I have a forwarding loop?

Look for “too many hops” errors, repeated Received headers, or logs showing the same message bouncing between the same hosts. Catch-all forwards are a common trigger.

On cPanel, what’s the fastest place to see why a forwarder failed?

WHM → Mail Delivery Reports for a quick view. For detail, read /var/log/exim_mainlog and search for the recipient or message ID.

Is it better to use IMAP instead of forwarding?

For business mail, yes. IMAP access avoids DMARC/forwarding edge cases and keeps delivery consistent. Forwarding remains fine for a few addresses if you enable SRS and avoid catch-all forwards.