Looking for email forwarding that doesn't rewrite headers badly

I have spent three weeks testing email forwarding services for a small privacy-focused newsletter operation. The requirement is strict: original headers must be preserved for SPF/DKIM alignment, no rewriting of Return-Path, no injection of X-Forwarded-For variants that confuse receivers.

Tested:

• GreenCloudVPS MailRoute: rewrites Return-Path to their domain, breaks DMARC
• Hetzner Forward: adds 3 X- headers, strips ARC
• Hostinger Relay: mangles Subject with [FWD] prefix, non-configurable
• Time4VPS MailPipe: actually clean headers but 48h delivery delays
• HostHatch Direct: perfect preservation, 99.9% delivery rate

HostHatch Direct is the only service that passes all tests. However at €0.008 per forwarded message, my projected monthly cost exceeds my entire hosting stack (CloudCone VPS + RackNerd CDN + KnownHost DNS) by 340%.

I am torn between operational integrity and economic proportionality. GDPR Article 5(1)(c) demands data minimisation but does not obviously mandate header preservation at any cost.

Has anyone found a middle path? Self-hosted options I should evaluate?

1) emotional response
A) frustration at the market
B) recognition of your thoroughness
2) technical analysis
A) self-hosted options
I) OpenSMTPD with relay table
Ii) Postfix with header_checks bypass
Iii) Rspamd for ARC sealing yourself
B) cost comparison
1) auction server: €15/month
2) IPv4 subnet: €8/month
3) your time: ???
3) recommendation
A) buy the HostHatch (https://hosthatch.com) if newsletter revenue > $50/month
B) self-host if time budget > 10 hours/month
C) accept breakage if neither condition met

Your framing conflates two distinct problems. SPF validates the envelope sender (SMTP MAIL FROM), which forwarding inherently breaks unless the forwarder rewrites or uses SRS. DKIM validates the message body and selected headers via cryptographic signature. Preservation of original headers is necessary for DKIM survival but insufficient for SPF.

HostHatch likely operates their own /24 with proper PTR, custom SPF records permitting their relay, and ARC signing with their own selector. This is correct architecture but expensive because it requires:

• Clean IP reputation maintenance (warming, monitoring RBLs)
• RPKI-validated routing announcements
• IRR-maintained route objects
• Direct peering or paid transit with deliverability SLA

For that money you get what BGP communities cannot discount: last-mile deliverability insurance. The pricing is actually reasonable for enterprise mail flow. Your hosting stack comparison is apples to oranges.