Sender Rewriting Scheme
A technique by which a forwarding server rewrites the envelope sender to an address in its own domain, so forwarded mail passes SPF at the next hop.
What it means
When a server forwards a message unchanged, the next receiver checks SPF for the original sender's domain against the forwarder's IP address, which that domain never authorized. SRS avoids the failure: the forwarder replaces the MAIL FROM address with one in its own domain that encodes the original address, a hash and a timestamp, and decodes it again if a bounce comes back.
Microsoft 365 applies SRS to mail auto-forwarded to external recipients, using addresses of the form user+SRS=hash=timestamp=domain=local@forwarding-domain.
SRS repairs SPF but not DMARC: the rewritten envelope domain belongs to the forwarder and does not align with the From domain. Forwarded mail passes DMARC only if the original DKIM signature survives, or if the receiver trusts ARC.
Example
MAIL FROM:<john.work+SRS=44ldt=IX=fabrikam.com=bob@contoso.com>Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- Microsoft Learn: Sender Rewriting Scheme (SRS) in Microsoft 365learn.microsoft.com
- RFC 7208, appendix D: SPF/Mediator Interactionsrfc-editor.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes