Why is a new IP address showing up in my GPT dashboard with SPF failing but DKIM passing?

Email marketer from MXToolbox shares you should always check the general health of your setup and identifies that incorrect MX records can lead to emails being routed through unexpected servers. It's important to verify the DNS records to ensure they're correctly pointing to your mail servers.

Email marketer from Litmus responds that failing SPF but passing DKIM can cause DMARC to fail if you have strict alignment policies. DMARC requires either SPF or DKIM to pass and align. Check your DMARC policy to see how it handles messages that fail SPF but pass DKIM.

Email marketer from StackOverflow answers question and suggests that someone else might be using your domain name to send email. If you're seeing a new IP address that you don't recognize, it could mean that someone is spoofing your domain. Make sure your SPF, DKIM, and DMARC settings are properly configured to prevent abuse.

Email marketer from Reddit suggests that the new IP address might be from a forwarding service or a mail server configured to relay emails. If the emails are being forwarded, SPF will fail since the IP address will not match the sending domain's SPF record. DKIM will pass if the message was signed before being forwarded.

Email marketer from Gmass explains sometimes old rules in your inbox can cause forwarding of emails. Check your Gmail or Google Workspace filters and forwarding settings. Disable any unwanted forwarding rules that could be sending emails from an unfamiliar IP address.

Email marketer from Email Geeks suggests tracking the DKIM selector with SPF Fail/DKIM Pass to understand the original outgoing server and observing the DMARC report reporter to identify potential auto-forwarding/routing cases.

Email marketer from Email Security Forum suggests if forwarding isn't the problem, it might indicate a compromised account or server. If the emails are being sent without your knowledge, someone may have gained unauthorized access. Secure your accounts and servers and check your logs for suspicious activity.

Email marketer from Mailgun Support explains that SPF failures often occur with email forwarding. When a mail server forwards a message, the originating IP address no longer matches the SPF record of the sender's domain, causing an SPF failure. DKIM, however, can still pass because the message content and signature remain intact.

Marketer from Email Geeks suggests regenerating the DKIM key at the ESP to address a potential compromise and deleting the public key component to prevent further message signing.

Email marketer from Email on Acid shares that if a new IP address is sending emails using your domain, it is vital to monitor its reputation. Even if DKIM is passing, poor IP reputation can affect deliverability. Check blacklists and sender scores associated with the new IP.

Expert from Email Geeks agrees that it sounds like forwarding may be the issue. SPF domain is valid but DKIM isn't.

Expert from Spam Resource discusses the implications of a new, unknown IP address sending mail from your domain. Even if DKIM passes, a sudden shift in sending IPs can negatively impact your sending reputation. Monitoring and understanding where that traffic is originating from is crucial to preventing deliverability issues.

Expert from Word to the Wise explains that SPF failures with passing DKIM often indicate a forwarding scenario. The original SPF check fails because the email is being sent from a different IP address than authorized, but the DKIM signature remains valid because the message content hasn't been altered.

Expert from Email Geeks suggests the issue might be due to mail forwarding.

Documentation from Microsoft describes SPF, DKIM and DMARC work together. A failing SPF can indicate that the email was sent from a server that is not authorized. Ensure that your SPF record includes all IP addresses or domains that send email on your behalf.

Documentation from DMARC.org states that DMARC relies on SPF and DKIM. An SPF failure with DKIM passing could indicate a forwarding issue or a problem with SPF configuration. The domain owner should investigate the source of the SPF failure to ensure legitimate mail isn't being affected.

Documentation from RFC Editor specifies how SPF is evaluated. An SPF check verifies if the connecting IP address is authorized to send email for the domain in the 'MAIL FROM' address. The standard explicitly states that forwarding will generally invalidate SPF results unless Sender Rewriting Scheme (SRS) is implemented.

Documentation from Google Workspace Admin Help explains that SPF and DKIM are independent authentication methods. SPF verifies the sender's IP address, while DKIM verifies the message's integrity via a digital signature. A message can pass DKIM even if SPF fails if the DKIM signature is valid.