SPF fail
The SPF result stating explicitly that the sending IP address is not authorized to use the domain, produced by a - qualifier such as -all.
What it means
fail is the domain owner saying this server may not send for the domain. What happens next is the receiver's choice. RFC 7208 says a receiver that rejects during the SMTP session should reply 550 with enhanced code 5.7.1, and one that accepts should record the result in a header for later filters.
Common causes for legitimate mail: a sending service missing from the record, mail sent from a new server, or forwarding, where the forwarder's IP address is checked against the original sender's record. The Sender Rewriting Scheme and ARC exist to soften the forwarding case.
Gmail's 550 5.7.26 rejections for SPF hard fail and the standard 5.7.23 code both point here.
Example
550 5.7.1 SPF MAIL FROM check failedRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 7208: Sender Policy Framework (SPF), section 2.6.4rfc-editor.org
- RFC 7208: Sender Policy Framework (SPF), section 8.4rfc-editor.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes