<html><body><div style="font-family: Helvetica; font-size: 12pt; color: #000000"><div>Hi guys,<br></div><div><br data-mce-bogus="1"></div><div>I have something weird. Most mails with valid SPF record are marked correctly (SPF_FAIL or SPF_PASS), but I see some messages which should be marked as SPF_PASS get no SPF_PASS<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Anonimised example:<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Return-Path: <some.user@somedomain.com><br>Received: from out1-36.antispamcloud.com (out1-36.antispamcloud.com [185.201.16.36])<br> (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))<br> (No client certificate requested)<br> by mail.vdb.eu (Postfix) with ESMTPS id 16EA01403EA<br> for <thom@vdb.nl>; Thu, 23 Jul 2020 09:43:03 +0200 (CEST)<br>Received: from [xx.xx.xx.xx] (helo=mail.somedomain.com)<br> by mx41.antispamcloud.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-SHA384:256)<br> (Exim 4.92)<br> (envelope-from <some.user@somedomain.com>)<br> id 1jyVsb-0001hb-Fv<br> for thom@vdb.nl; Thu, 23 Jul 2020 09:43:02 +0200<br>Content-Type: multipart/related;<br> boundary="_2c714b49-0f22-469c-ac6b-a16d0bccfe6b_"<br>Received: from someinternalserver (10.14.1.110) by internalserver.somedomain.com<br> (10.14.1.100) with Microsoft SMTP Server id 14.3.487.0; Thu, 23 Jul 2020<br> 09:38:57 +0200<br>MIME-Version: 1.0<br>Date: Thu, 23 Jul 2020 09:38:57 +0200<br>To: <thom@vdb.nl><br>From: Some User <some.user@somedomain.com><br>Reply-To: < <!--StartFragment-->some.user@somedomain.com<!--EndFragment--> ><br>Subject: Some subject<br>(...)<br>X-Report-Abuse-To: spam@quarantine10.antispamcloud.com<br>X-vdbeu-MailScanner-Information: Please contact the ISP for more information<br>X-vdbeu-MailScanner-ID: 16EA01403EA.A1841<br>X-vdbeu-MailScanner: Found to be clean<br>X-vdbeu-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,<br> score=-1.786, required 5, BAYES_00 -1.90, HTML_MESSAGE 0.00,<br> KAM_DMARC_STATUS 0.01, MIME_HTML_ONLY 0.10, RCVD_IN_DNSWL_NONE -0.00,<br> RCVD_IN_MSPIKE_H4 0.00, RCVD_IN_MSPIKE_WL 0.00, SPF_HELO_NONE 0.00)<br>X-vdbeu-MailScanner-From: some.user@somedomain.com<br><br>SPF record for the senders domain:<br><br>v=spf1 a mx ip4:y.y.y.y ip4:y.y.y.y ip4:y.y.y.y ip4:xx.xx.xx.xx include:spf.antispamcloud.com include:spf.protection.outlook.com include:include.com include:some.otherinclude.com ~all<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>The host my server (mail.vdb.eu) receives the mail from ( <!--StartFragment-->out1-36.antispamcloud.com<!--EndFragment--> ) which is a valid sender.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>When I run the headers of the mail via the "Header analyse" tool at mxtoolbox.com it says "SPF Authenticated" (see attached image)<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Versions:<br data-mce-bogus="1"></div><div>MailScanner: 5.3.3 <br data-mce-bogus="1"></div><div>Postfix: 3.3.0<br data-mce-bogus="1"></div><div> <!--StartFragment-->Mail::SPF<!--EndFragment--> v2.009 <br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Any clues where to dig deeper?<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div> <!--StartFragment--><br></div><div><br></div><div data-marker="__SIG_PRE__"><div>Met vriendelijke groet, Best regards,</div><div><br></div><div><br style="font-family:'helvetica'"><span style="font-family:'helvetica'">Thom van der Boon</span><br style="font-family:'helvetica'"><span style="font-family:'helvetica'">E-Mail: thom@vdb.nl</span></div><div><br data-mce-bogus="1"></div></div></div></body></html>