SPF Softfail (=spam)
I have my custom domain set up to use mailbox.org as a email service. My email address is "nuc1eon@neonsys.org".
I have set up DMARC and SPF according to the mailbox.org docs.
But recently I send an email to an address and received back a Google report, which reports a "SPF softfail". I have attached the detailed XML report provided by Google in that email.
I have therefore checked my email (nuc1eon@neonsys.org) with multiple online tools. Here are the results, eg.: https://mecsa.jrc.ec.europa.eu/en/finderRequest/32b5082f5e192a8ab57237e0549e9cfd or https://easydmarc.com/tools/spf-lookup?domain=neonsys.org here. However according to all reporting tools that I have tried, my SPF record is set up correctly.
My set up is like this:
MX neonsys.org mxext2.mailbox.org 600 10 MX neonsys.org mxext3.mailbox.org 600 20 MX neonsys.org mxext1.mailbox.org 600 10
TXT neonsys.org v=spf1 include:mailbox.org ~all 600I also have the DMARC entries set up, but not publishing here, since I don't think they are relevant here. DMARC is reported as "passed" in the Google XML report.
I don't understand why Google has classified my SPF settings as "softfail" (=spam). Also I don't know how I can debug this, since all online tool' that I have tried are reporting positive results.
I would be grateful for help.
The same problem 
I have the same problem with my setup, with spf and dkim suddenly failing.
One domain outright rejected my mails and Amazon and Google started to send me quarantine reports.
I have the same problem with my setup, with spf and dkim suddenly failing.
One domain outright rejected my mails and Amazon and Google started to send me quarantine reports.
Your spf record ends with ~all, which means softfail. You could switch it to -all, but ~all is best practice when combined with DKIM and DMARC (see https://www.uriports.com/blog/spf-dkim-dmarc-best-practices/). Your DMARC says p=none. It should be p=quarantine or p=reject. And you don't have DKIM configured, which you should also correct.
Your spf record ends with ~all, which means softfail. You could switch it to -all, but ~all is best practice when combined with DKIM and DMARC (see https://www.uriports.com/blog/spf-dkim-dmarc-best-practices/). Your DMARC says p=none. It should be p=quarantine or p=reject. And you don't have DKIM configured, which you should also correct.
Replies have been locked on this page!