Munchable has a public support form , and it also has a catch-all: the MX records for the domain point at Resend, so mail sent to any address at munchable.app arrives at one webhook. Three addresses open a support ticket, replies to our own mail are threaded onto the ticket they answer, and everything else is forwarded to a personal inbox.

That forward is where the problem is, and it took me a while to see it, because it does not look like a filtering problem at all.

The forward launders the sender

When the webhook forwards a message, it sends a new email from our own authenticated domain, with Reply-To set to the original sender. The receiving inbox therefore sees mail from munchable.app, a domain with good DKIM, good SPF and a clean reputation, which the recipient has corresponded with constantly.…