Why do SPF and DKIM failures sometimes occur despite correct setup?
Summary
What email marketers say8Marketer opinions
Email marketer from Email Authentication Blog responds that SPF/DKIM failures happen when email forwarding occurs and the recipient sees the forwarding server's IP. DKIM is less susceptible to forwarding issues because it validates the content of the email, not the sending server.
Email marketer from Mailjet shares that SPF failures can occur even with correct setup due to email forwarding, where the forwarder's server IP isn't authorized in the SPF record. Using a service that manages authentication can help.
Email marketer from Reddit explains that one common reason for SPF failure despite correct setup is forwarding. When an email is forwarded, the IP address of the forwarding server becomes the sending IP, which likely isn't included in the original sender's SPF record. This results in an SPF failure.
Email marketer from StackExchange answers that SPF failures often occur with mailing lists. When a mailing list server forwards the email, it acts as an intermediary, and the recipient server checks the SPF record against the mailing list server's IP, not the original sender. Using DKIM is recommended for mailing lists to avoid this.
Email marketer from AuthSMTP explains that SPF and DKIM failures can still occur even with correct setup because of forwarding which changes the sending server. They advise using DKIM as it is more resilient to forwarding.
Email marketer from Web Hosting Forum shares that SPF failures sometimes occur because of autoresponders or vacation replies. When an autoresponder sends a reply, it originates from a different server, which may not be authorized in the original sender's SPF record, leading to a failure.
Marketer from Email Geeks explains that forwarders can cause SPF and DKIM failures. The message is sent from you to the first recipient, who then forwards it. SPF and DKIM often break in the second step.
Email marketer from EasyDMARC responds that SPF failures happen due to forwarding, use of multiple email service providers, or misconfigured SPF records. Regularly auditing your SPF records and using DMARC can help mitigate these issues.
What the experts say3Expert opinions
Expert from Spam Resource, John Levine, explains that SPF failures often occur due to forwarding. When a mail server forwards a message, the recipient server sees the forwarder as the sender. If the forwarder's IP address isn't included in the original sender's SPF record, the SPF check will fail, even if the original setup was correct.
Expert from Word to the Wise, Laura Atkins, shares that SPF failures are commonly seen when Microsoft (Hotmail) forwards messages. When they forward, the SPF record doesn't always align and often causes SPF fails. She recommends reviewing forwarding practices and authentication methods when sending to Microsoft addresses.
Expert from Email Geeks shares that DKIM will sometimes randomly fail for reasons such as DNS retrieval issues or body modification during forwarding. A 0.1% DMARC failure rate is normal.
What the documentation says3Technical articles
Documentation from Microsoft explains that SPF failures can happen because of incorrect SPF record syntax, exceeding DNS lookup limits, or forwarding. Also, make sure the sending server's IP address is included in the SPF record of the sending domain.
Documentation from dmarcian explains that SPF failures often occur with forwarding because SPF checks the sending server's IP address against the domain's SPF record. When a forwarder sends the email, the recipient sees the forwarder's IP, which is unlikely to be authorized by the original sender's SPF record.
Documentation from Google explains that SPF failures can occur when emails are forwarded. When a server forwards a message, the recipient server sees the forwarding server as the sender, causing the SPF check to fail if the forwarding server isn't authorized in the SPF record.