什么是电子邮件转发？
电子邮件转发是一种邮件路由配置，会将收到某个电子邮件地址的邮件自动重定向到另一个目标地址。邮件到达转发地址后，邮件服务器会立即将其发送到目标地址，而不会存储在原始邮箱中。
电子邮件转发如何工作
1. Email sent to: [email protected]
2. Mail server receives at MX: mail.example.com
3. Server checks forwarding rules
4. Email forwarded to: [email protected]
5. Team receives email (appears from original sender)
转发后的邮件会保留原始发件人信息，因此回复会发送给原始发件人，而不是转发地址。
电子邮件转发类型
简单转发
一个地址转发到一个目标：
[email protected] → [email protected]多目标转发
一个地址转发给多个收件人：
[email protected] → {
}
条件转发
根据条件进行转发：
If subject contains "urgent" → [email protected]
If from VIP domain → [email protected]
Else → [email protected]
域级转发
将一个域名的所有邮件转发到另一个域名：
*@old-domain.com → *@new-domain.com配置电子邮件转发
cPanel
1. Email → Forwarders
2. Add Forwarder
3. Address to Forward: [email protected]
4. Forward to: [email protected]
5. Add Forwarder
Postfix（Linux）
# /etc/aliases
sales: [email protected]
# Or for virtual domains
# /etc/postfix/virtual
[email protected] [email protected]
# Apply changes
newaliases # For /etc/aliases
# or
postmap /etc/postfix/virtual && systemctl reload postfix
Gmail 转发
1. Settings → Forwarding and POP/IMAP
2. Add a forwarding address
3. Verify forwarding address (click link in confirmation email)
4. Enable forwarding
5. Choose what to do with original (keep, archive, delete)
Microsoft 365
1. Admin Center → Users → Active users
2. Select user → Mail tab
3. Email forwarding → Manage email forwarding
4. Forward all email to: [email protected]
5. Save changes
Google Workspace（域级）
1. Admin Console → Apps → Google Workspace → Gmail
2. Routing → Add Route
3. For recipient: Single recipient or All recipients
4. Forward to: [email protected]
5. Options: Change route, Modify headers
电子邮件转发与别名
| 特性 | 转发 | 别名 |
|---|---|---|
| 投递位置 | 另一个地址 | 同一邮箱 |
| 原始地址存储 | 否 | 是 |
| 在邮箱中显示 | 否 | 是（作为别名） |
| 身份验证 | 可能破坏 SPF/DKIM | 保持身份验证 |
| 适用场景 | 外部路由 | 多个地址 → 一个收件箱 |
Alias:
[email protected] } → Same mailbox
[email protected] } (both deliver to mailbox, different addresses)
Forwarding:
[email protected] → [email protected]
(only delivers to [email protected], nothing in sales mailbox)
SPF 与电子邮件转发
电子邮件转发会带来 SPF 挑战，因为转发服务器代表原始发件人发送邮件：
问题
1. Sender: [email protected] sends to [email protected]
2. Forwarder: [email protected] forwards to [email protected]
3. Final server checks SPF:
- Envelope From: [email protected]
- Sending IP: forwarder.com's IP
- SPF Check: Does sender.com authorize forwarder.com's IP?
- Result: Usually FAIL (forwarder not in sender.com's SPF)
解决方案
SRS（发件人重写方案）：Forwarder rewrites envelope sender:
Original: MAIL FROM: <[email protected]>
Rewritten: MAIL FROM: <[email protected]>
Now SPF checks forwarder.com's SPF (passes)
# Install postsrsd
apt-get install postsrsd
# /etc/postfix/main.cf
sender_canonical_maps = tcp:127.0.0.1:10001
recipient_canonical_maps = tcp:127.0.0.1:10002
systemctl restart postsrsd postfix
在转发过程中保留身份验证结果：
ARC-Authentication-Results: forwarder.com;
spf=pass smtp.mailfrom=sender.com
dkim=pass header.d=sender.com
DKIM 与转发
如果转发服务器修改邮件，DKIM 签名可能失效：
会破坏 DKIM 的常见修改
- 在邮件正文中添加免责声明
- 在主题前添加“[FORWARDED]”
- 将纯文本转换为 HTML
- 更改换行或编码
保留 DKIM
尽量减少修改：# Postfix: Don't add disclaimers to forwarded mail
smtpd_discard_ehlo_keywords = silent-discard
# Add forwarder's DKIM signature
# Original sender's signature may break, but forwarder's passes
电子邮件转发最佳实践
谨慎使用转发
可能时优先使用别名或共享邮箱：
Instead of: [email protected] → [email protected]
Use: John checks [email protected] directly via IMAP/webmail
对外部转发实施 SRS
将邮件转发到域名外部时尤其必要：
Internal forwarding: [email protected] → [email protected] (safe)
External forwarding: [email protected] → [email protected] (use SRS)
监控转发循环
防止无限转发：
A forwards to B
B forwards to A
= Loop
Solution: Postfix max_hop_count limit (default 50)
设置投递通知
在转发失败时接收通知：
# Postfix
notify_classes = bounce, resource, software
记录转发规则
维护清单：
# forwarding-rules.md
| From | To | Purpose | Owner | Created |
|------|----|---------| ------|---------|
| [email protected] | [email protected] | CRM integration | IT | 2024-01 |
定期审查
检查并清理：
# List all forwards (Postfix)
grep -v "^#" /etc/postfix/virtual | grep "@.*@"
# Check for outdated destinations
# Remove forwards for terminated employees
常见转发问题
转发无提示地失败
症状：发送到转发地址的邮件消失 原因：- 目标地址不存在
- 目标服务器拒绝转发邮件
- 检测到转发循环并中断
# Check mail logs
tail -f /var/log/mail.log | grep "forwarding"
# Test forwarding
echo "Test" | mail -s "Test" [email protected]
# Check if it arrives at destination
转发邮件的 SPF 失败
症状：转发邮件被标记为垃圾邮件或被拒绝 解决方案：实施 SRS（见上文）。转发延迟
症状：转发邮件延迟数分钟或数小时到达 原因：- 转发服务器队列积压
- 目标服务器启用灰名单
- 受到速率限制
# Check Postfix queue
mailq
# Process queue immediately
postqueue -f
目标服务器将转发邮件标为垃圾邮件
症状：正常转发邮件进入垃圾邮件文件夹 原因：- SPF/DKIM 失败
- 转发服务器 IP 声誉不佳
- 目标服务器不信任转发服务器
- 在转发服务器上实施 ARC
- 在目标服务器将转发服务器 IP 列入允许名单
- 使用 SRS 重写信封发件人
特定场景下的转发
临时转发（休假）
# .forward file (user home directory)
\myuser, [email protected]
# Delivers to both user's mailbox and colleague
转发并保留本地副本
# Keep copy in original mailbox while forwarding
# Postfix virtual:
部门分发
# /etc/aliases
sales: [email protected], [email protected], [email protected]
外部服务集成
# Forward to ticket system
[email protected] → [email protected]
# Forward to Slack email
安全考量
转发到个人邮箱
风险：
- 企业数据进入不安全的个人账户
- 失去合规控制
- 没有备份或归档
外部转发披露
GDPR 考量：转发可能构成数据共享。
将转发作为攻击向量
被入侵的账户可能会设置转发以窃取邮件：
# Detection
# Alert on new forwarding rules:
monitor /etc/postfix/virtual for changes
monitor Exchange/M365 forwarding rule creations
测试电子邮件转发
测试转发链：# Send test email
echo "Test forwarding" | mail -s "Forwarding Test" [email protected]
# Check logs on forwarding server
tail -f /var/log/mail.log
# Verify arrival at destination
# Check destination mailbox
Send email through forwarding chain
Check authentication headers at destination:
Authentication-Results: destination.com;
spf=pass (forwarder: domain of source.com designates <IP> as permitted sender)
dkim=pass header.d=source.com
电子邮件转发很有用，但需要仔细配置才能保持良好的送达率和安全性。