Find the real sending system#
List the systems that send using your domain: mailbox service, forms, CRM and transactional provider. Compare the envelope sender and observed sending IP for an affected message with the configuration you intended.
Interpret the result#
SPF checks whether a sending host is authorized for the evaluated domain. Softfail is a policy result; it does not, by itself, predict a particular inbox folder. A message may also have a DKIM result and be subject to the receiver’s other decisions.
Change one thing with evidence#
Correct a missing legitimate sender using the provider’s exact instructions. Avoid adding broad authorization just to remove a warning. Send a controlled message to a mailbox you own, inspect its authentication headers and retain the before-and-after evidence.
Primary references
Consult the current specification or provider guidance when applying these checks.
SPF specification