Known forwarders are third party systems that are known to do automated forwarding of emails. Known Forwarders are systems that Helios knows about and will display with a user friendly name.  Known Forwarders appear in two different places in the Authentication Dashboard. 


The first is as a drill down of a specific service. This shows emails that originated with the service but were then forwarded by the Known Forwarder. In some cases, there will be a Known Forwarder called ‘Unknown’ This shows the authentication status for emails that were known to have originated with the service but were forwarded through a third party for which Helios does not have a user friendly name.


The second place that Known Forwarders appears is as a drill down beneath Unidentified Senders. This shows emails that are known to have been forwarded but which Helios is not able to determine the actual originating service.

The reason that the originating service may not be identifiable comes down to two main reasons:

  1. In many cases, when an email is forwarded, the forwarder will change the return path to be themselves. If the email is not DKIM signed, Helios can not identify the originator using the return path.

  2. Some email receivers do not include the DKIM selector for DKIM signed emails in the DMARC reports. When the email is forwarded in these cases, Helios can not identify the service based on the DKIM selector.