SPF Fail: sender not authorized
The sending IP address is not listed in your SPF record. Receivers treat the message as unauthorized.
A hard SPF fail is the strongest possible negative signal. With DMARC p=reject your mail is bounced. With p=quarantine it lands in Junk. Even without DMARC, every receiver's spam score takes a serious hit.
What causes it
- You started sending through a new service (newsletter platform, CRM, support desk) but didn't update your SPF record to include their sending infrastructure.
- Your mail provider rotated their IP pool and your SPF
ip4:ora:entries are stale. - You're sending through a server on your own network that isn't covered by any of your SPF mechanisms.
- You're forwarding mail — SPF doesn't survive forwarding unless the forwarder uses SRS.
How to fix it
Step 1: Find the actual sending IP
In the Received headers of a failed message, find the first external hop — that's the IP SPF is evaluating. Compare it against your SPF record.
Step 2: Add the sender
For a managed service, use their recommended include: statement (e.g., include:_spf.google.com). For a specific IP, add ip4:
/32. Keep the record under 10 lookups.Step 3: Handle forwarders
If the fail only happens on forwarded mail, the real fix is DMARC alignment via DKIM — DKIM survives forwarding, SPF doesn't. Enable DKIM so DMARC passes via dkim-alignment even when SPF fails.
Fixed it? Run a fresh test to confirm.
Test my inbox →