Problem

You have added a sender's email address or domain to your Filtering Rules as an allowed sender, but messages from that sender are still being rejected with an SPF failure.


Why This Happens

SPF checks are performed during the SMTP session — before the message is even fully received by our servers. If the sending domain's SPF record instructs mail servers to hard-fail (-all) for the sending IP address, our servers respect that instruction and reject the connection at that point.


This is a decision made by the owner of the sending domain. They have explicitly told the internet that they do not want anyone to accept messages sent from their domain that fail SPF. Our servers follow the rules of SPF mail handling accordingly.


Because the rejection happens at this early stage, our servers never get as far as receiving the full message and checking it against your Filtering Rules or spam filters. The allow rule is never reached.


This behavior applies to all DuoCircle inbound email services, including Email Gateway, Phishing Protection, Email Forwarding, and Alumni Forwarding.


Resolution

Option 1 — Ask the sender to fix their SPF record (recommended)

The correct fix is for the sending organization to update their SPF record to authorize the IP address their mail is being sent from. Share the rejection error with them — it will include the sending IP and the domain whose SPF record failed, which is the information they need to correct the record.


Option 2 — Temporarily disable SPF Checking

If you cannot get the sender to fix their SPF record and need to receive their mail urgently, you can temporarily disable SPF Checking:

  1. Go to your Service configuration options.
  2. Click the Enabled value next to the SPF Checking field.
  3. A dialog box will appear — click Yes to disable it.
  4. Trigger the workflow or ask the sender to resend the message.
  5. After you receive the message, return to the same setting and re-enable SPF Checking.


Note: Disabling SPF Checking does lower your email security by a small amount and should not be left off for any extended period. However, it does not disable spam scanning or antivirus checks, so many would consider it an acceptable short-term risk to receive an important message from a sender whose SPF is mis-configured.