# SPF: Received-SPF: softfail (google.com: domain of transitioning bounce@example.com does not designate 203.0.113.5 as permitted sender)

**Code:** `SPF fail / softfail: sender IP not authorized` · **Category:** Email / SMTP · **Seen on:** SMTP

The server that sent the mail is not listed in the sender domain's SPF record, so the receiver marks it fail or softfail.

## Meaning

SPF compares the connecting IP with the policy of the envelope sender (Return-Path) domain. Add the sending service's `include:` or IP to your record. `~all` gives softfail and `-all` hard fail; both hurt delivery when combined with a DMARC policy. Forwarded mail also breaks SPF.

## Common causes

- Sending service/IP not included in SPF
- SPF record for a different domain than the Return-Path
- Mail forwarded through another server
- Typo in the record
- SPF only published on the From domain while the bounce domain differs

## Quick fix

1. Add the service's include or IP and verify with an SPF checker
2. Check which domain is in Return-Path and publish SPF there
3. Rely on DKIM for forwarded mail and set DMARC accordingly

## Detailed fix by platform

### Linux

1. View the verdict in the raw message header `Received-SPF:` / `Authentication-Results: spf=...`

## How to diagnose

1. **IP** — Sending IP in the record?
2. **Domain** — Return-Path domain correct?
3. **Forwarding** — Mail forwarded?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/email/spf-fail-or-softfail-no-match)