Hello, I manage 2 office 365 different domain, let say domain1.com and domain2.com then i test send mail from domain1.com to domain2.com When i see header of sent message on domain2.com, the header contains ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=softfail (sender ip is 205.220.172.220) My SPF for domain1.com is v=spf1 include:spf.protection.outlook.com ~all My question is : is 205.220.172.220 not belong to one of ip address of spf.protection.outlook.com so the recipent mail server say the spf result is softfail? Are i have miss configuration on the SPF record?

Hi, 205.220.172.220 isn't included in the SPF record for spf.protection.outlook.com which is the reason for the soft fail. That IP belongs to Proofpoint so I'm guessing you are routing outgoing email from domain1 through Proofpoint's servers. Why you can do is modify domain1's SPF record so that it includes Proofpoint's outgoing servers. I bet the information on their IP addresses/what to put in SPF record are on their support site. Please click Accept Answer if the above was useful. Thanks. -TP

SPF Softfail - Microsoft Q&A

Accepted answer

TP 91,021 Reputation points

2023-09-27T04:55:09.9266667+00:00

Hi,

205.220.172.220 isn't included in the SPF record for spf.protection.outlook.com which is the reason for the soft fail. That IP belongs to Proofpoint so I'm guessing you are routing outgoing email from domain1 through Proofpoint's servers.

Why you can do is modify domain1's SPF record so that it includes Proofpoint's outgoing servers. I bet the information on their IP addresses/what to put in SPF record are on their support site.

Please click Accept Answer if the above was useful.

Thanks.

-TP
Please sign in to rate this answer.
Handian Sudianto 4,856 Reputation points

2023-09-27T05:52:47.8966667+00:00

Hi

How we can check in exchange admin if oubound message is routed to proofpoint?

TP 91,021 Reputation points

2023-09-27T06:24:51.73+00:00

Please see this document on their site: https://help.proofpoint.com/Proofpoint_Essentials/Email_Security/Administrator_Topics/hostedemailservices/Configuring_Microsoft_365_for_Proofpoint_Essentials

The other thing you can check is if domain2 is configured for all incoming mail to be sent to proofpoint first. You can check MX record for domain2 to see which servers it is pointing to.

Handian Sudianto 4,856 Reputation points

2023-09-27T06:27:18.25+00:00

Just test send from domain1 to domain2 and to gmail

On domain2 i got spf error because the sender detect using IP 205.220.172.220, but on gmail the spf is pass.

Maybe we have issue or miss config on domain2?

TP 91,021 Reputation points

2023-09-27T06:31:52.7733333+00:00

Check if incoming mail for domain2 is being sent to proofpoint first. nslookup -q=MX domain2.com

Handian Sudianto 4,856 Reputation points

2023-09-27T06:36:11.24+00:00

Hi ..

yes MX for domain2 pointed to pphosted, and of course anyone who send mail to domain2 will have spf softfail because the sender not have IP pphosted on their SFP. Am i right?

TP 91,021 Reputation points

2023-09-27T06:38:53.4033333+00:00

Correct
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

SPF Softfail

0 additional answers

Your answer