SPF fail / softfail: sender IP not authorized Email / SMTP Origin: Network Last updated 4 Nov 2026

SPF: Received-SPF: softfail (google.com: domain of transitioning bounce@example.com does not designate 203.0.113.5 as permitted sender)

The server that sent the mail is not listed in the sender domain's SPF record, so the receiver marks it fail or softfail.

Exact message you may see Received-SPF: softfail domain does not designate as permitted senderspf=fail does not designate permitted senderSPF softfailspf=softfail (google.com: domain of transitioningspf=neutral sender IP not authorized
Explore the map of this error Full error map →
Seen on: SMTP

Meaning

SPF compares the connecting IP with the policy of the envelope sender (Return-Path) domain. Add the sending service's include: or IP to your record. ~all gives softfail and -all hard fail; both hurt delivery when combined with a DMARC policy. Forwarded mail also breaks SPF.

Common causes

  • Sending service/IP not included in SPF
  • SPF record for a different domain than the Return-Path
  • Mail forwarded through another server
  • Typo in the record
  • SPF only published on the From domain while the bounce domain differs

⚡ Quick fix

  1. Add the service's include or IP and verify with an SPF checker
  2. Check which domain is in Return-Path and publish SPF there
  3. Rely on DKIM for forwarded mail and set DMARC accordingly

Detailed fix by platform

Linux

  1. View the verdict in the raw message header Received-SPF: / Authentication-Results: spf=...

How to diagnose

  1. IP — Sending IP in the record?
  2. Domain — Return-Path domain correct?
  3. Forwarding — Mail forwarded?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

550 5.7.25 PTR record required — SMTP: 550-5.7.25 The IP address sending this message does not have a PTR record setup, or the corresponding forward DNS entry does not point to the sending IP (Email / SMTP)550 5.7.25 PTR record…550 5.7.26 — 550 5.7.26 This mail has been blocked because the sender is unauthenticated (SPF/DKIM/DMARC) (Email / SMTP)550 5.7.26DKIM: no key for signature — DKIM: dkim=permerror (no key for signature) / key not found in DNS selector._domainkey (Email / SMTP)DKIM: no key for sign…DMARC fail: SPF and DKIM not aligned — DMARC: dmarc=fail (p=REJECT) — SPF and DKIM pass but domains are not aligned with the From header (Email / SMTP)DMARC fail: SPF and D…DMARC: no record found — DMARC: dmarc=none (no DMARC record found for example.com) — bulk sender requirements not met (Email / SMTP)DMARC: no record foundSPF PermError: too many DNS lookups — SPF: spf=permerror — Too many DNS lookups (limit is 10) (Email / SMTP)SPF PermError: too ma…SPF: multiple SPF records — SPF: spf=permerror — Multiple SPF records found for example.com (Email / SMTP)SPF: multiple SPF rec…SPF fail …

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.