DIAGNOSTIC PLAYBOOK
SPF fails only over IPv6
An IPv6 delivery path can fail SPF even when messages sent over IPv4 pass. The two address families need authorization through the policy evaluated for the same envelope identity.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Compare source addresses in passing and failing samples to establish whether the difference is consistently IPv6.
- Inspect the record and provider includes for coverage of the actual IPv6 sender.
- For infrastructure you own, authorize the intended IPv6 address or documented range and retest both paths.
What this looks like
ILLUSTRATIVE EXAMPLE
An application server sends from an authorized IPv4 address until its network begins preferring IPv6. The original ip4 mechanism has no effect on that IPv6 connection.
A mistake to avoid
Do not authorize a broad network range just to make a test pass. Shared and provider-controlled infrastructure should follow the operator's instructions.
Keep the result in context
SPF evaluates the SMTP client against the envelope sender domain, or the HELO identity in the applicable case. A record lookup can identify publication problems; a message result also needs the actual sending IP and identity. Keep those inputs with your investigation.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.