An SPF pass is one result, not a delivery decision
Read the remote rejection and the authenticated domains: SPF can pass for an envelope domain that does not align with visible From.
SPF pass authenticates the envelope sender’s domain, which may differ from visible From. DMARC needs aligned passing SPF or DKIM, and a DMARC pass still does not require recipient acceptance. Use the exact rejection to distinguish alignment from content, reputation or recipient policy before editing records.
Work with the owner of the sending service and the intended recipient. Mailbox sending and outbound filtering are available only where that service is actually entitled. Do not relax domain policy, add an IP to SPF, or disable filtering on the strength of a single “SPF pass” label.
Collect the actual rejection evidence
Save the complete bounce or SMTP rejection code, timestamp with time zone, recipient domain, message identifier and sending route. Separate a client failure before submission from a message accepted by your provider and later rejected by a remote system. The latter may have a delivery-status notification; the former requires the submission troubleshooting guide. Obtain the authentication-results header from a delivered copy to a controlled mailbox, or ask the recipient administrator for their result. Redact addresses and content before sharing logs.
Identify the visible From: domain, the envelope sender or Return-Path domain used for SPF, and any DKIM d= signing domain. Beware that a forwarded or mailing-list copy can have different authentication results from the original.
Compare alignment with the rejection reason
If SPF passes for a domain unrelated to visible From, it does not by itself satisfy DMARC. Check whether a valid DKIM signature aligns instead. The current DMARC protocol permits a pass when at least one of aligned SPF or aligned DKIM passes, subject to the published alignment modes. If the rejection explicitly names DMARC failure, identify which identifier failed and why before changing DNS. A DKIM failure may reflect an absent selector, body changes or a sending service that did not sign; use the existing DKIM guide for the authorised fix.
For From: example.com and smtp.mailfrom=sender.example.net, an SPF pass for the latter needs an aligned DKIM pass or another aligned authentication route for DMARC.
If DMARC passes but the remote server rejects the message, look at its enhanced status code and text for a content, reputation, rate or recipient policy reason. If the bounce only says “SPF”, check whether it describes a true SPF fail, a malformed policy, or the receiving system’s own shorthand. Do not infer the exact cause from a dashboard badge.
Repair the responsible sender and retest
For an alignment failure, have the sender operator configure an authorised aligned envelope domain or DKIM signing domain supported by that service. For a different rejection, follow the actual remote error and ask the receiving administrator for its policy decision if needed. Make one bounded change, send a fresh message from the same route and inspect its authentication-results and delivery outcome. A test to a different receiver can prove your sender works there but cannot prove the original receiver will accept it.
If a change worsens delivery, restore the prior sender configuration and DNS record from the saved state. Preserve the rejection transcript and DNS answers for support. Do not share full private messages or credentials in a public ticket.
Common questions
Should I add the recipient to SPF? No. SPF authorises senders for a domain, not recipients.
Can DMARC pass and mail still be rejected? Yes. The receiver applies other policies.
Does DKIM need to pass if SPF passes? DMARC needs one aligned passing method; inspect the actual domains and results.
Does a successful test at another recipient clear the original rejection? No. Use the original receiver's code and policy evidence.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.