SPF fails: the sending server is not authorized

What it means

Your domain has an SPF record, the list of servers allowed to send email for you. But the email you tested came from a server that is not on that list. The receiver sees it as a possible fake.

The result may be shown as "fail" (your record ends with -all) or "softfail" (your record ends with ~all).

Why it matters

A failed SPF is a strong spam signal. If DKIM does not save the day, DMARC fails too, and your email can go to spam or be refused. It usually means one of your sending tools was forgotten when SPF was set up.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. The SPF line shows the IP address of the server that sent the email and which domain was checked.
• Use the Domain scanner: type your domain at /domain-scanner to read your DNS records without sending anything.

The report's "Sending infrastructure" section also tells you which provider the email came from. That is your clue.

How to fix it

1. Identify the sender. Did the test come from your normal mailbox, your website, your shop, a newsletter tool or a printer/scanner? Look at the provider name and IP address in the report.
2. Find that service's SPF value in its help pages. Search for "SPF" plus the service name.
3. Add it to your existing SPF record. Do not create a second record: edit the one you have.

Examples

You use Google Workspace and forgot your newsletter tool:

v=spf1 include:_spf.google.com include:spf.newsletter-example.com ~all

Your website sends contact-form emails from its own server, IP 203.0.113.10:

v=spf1 include:spf.protection.outlook.com ip4:203.0.113.10 -all

Common situations

• Moved to a new provider: the SPF still lists the old one. Replace it with the new include.
• Microsoft 365: the value is include:spf.protection.outlook.com.
• Google Workspace: the value is include:_spf.google.com.
• Website (WordPress, shop): these often send directly from the web host. A better option is to make the site send through your mailbox provider or an email service with an SMTP plugin, so it is already covered.
• Forwarding: if an email is forwarded by another server, SPF may fail even when everything is right. DKIM is what survives forwarding, so make sure DKIM is set up too.

Which domain is checked?

SPF checks the hidden "envelope" sender (also called Return-Path), not always the address people see. Many newsletter tools use their own domain there. In that case, SPF passes for their domain, and you need DKIM on your own domain for DMARC to pass. See the guide on DMARC alignment.

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.

Send a new test email from the same service that failed. The report should now show SPF as passing for the sending IP. If you use several tools, test each one.