# The default SPF record fails now with microsoft

**URL:** <https://discourse.mailinabox.email/t/the-default-spf-record-fails-now-with-microsoft/12743>\
**Category:** Maintenance\
**Created:** [March 11, 2025, 7:17am UTC](https://discourse.mailinabox.email/t/the-default-spf-record-fails-now-with-microsoft/12743 "2025-03-11T07:17:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![miabuser12345](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/m/8dc957/32.png) [@miabuser12345](https://discourse.mailinabox.email/u/miabuser12345)\
**Post date:** [March 11, 2025, 7:17am UTC](https://discourse.mailinabox.email/t/the-default-spf-record-fails-now-with-microsoft/12743/1 "2025-03-11T07:17:26Z")

</div>

I got this delivery result all of a sudden from MS

Authentication-Results: spf=fail (sender IP is x)  
smtp.mailfrom=y.z; dkim=pass (signature was verified)  
header.d=y.z;dmarc=pass action=none header.from=y.z;compauth=pass  
reason=100  
Received-SPF: Fail ([protection.outlook.com](http://protection.outlook.com): domain of y.z does not  
designate x as permitted sender)

The email had gotten a SCL of 9 so that went straight into the recipients SPAM folder

overriding the SPF record to not use mx but use ip4:{server ip} does pass the MS checks and results in the same email getting an SCL score of 1.

I am not sure what changed.

Can anyone have any tips on how to stabilize the situation? why did mx in the spf record not work?

---

<div class="post-metadata">

**Author:** ![vele](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/v/e5b9ba/32.png) [@vele](https://discourse.mailinabox.email/u/vele)\
**Post date:** [March 11, 2025, 10:05am UTC](https://discourse.mailinabox.email/t/the-default-spf-record-fails-now-with-microsoft/12743/2 "2025-03-11T10:05:28Z")

</div>

Check with the spf checker. Here [SPF Surveyor - dmarcian](https://dmarcian.com/spf-survey/)  
You should have at least

> v=spf1 mx

My dkim fails from time to time on outlook. It is a bug with them. It never fails on Gmail.

1

\<policy\_evaluated\>

none

dkim fail dkim

spf pass spf

---

<div class="post-metadata">

**Author:** ![miabuser](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/m/eb9ed0/32.png) [@miabuser](https://discourse.mailinabox.email/u/miabuser)\
**Post date:** [March 11, 2025, 10:36am UTC](https://discourse.mailinabox.email/t/the-default-spf-record-fails-now-with-microsoft/12743/3 "2025-03-11T10:36:58Z")

</div>

Afaik, the default SPF record in Mail in a Box is `"v=spf1 mx -all"`, which should work if you’re sending mail directly from your box, and if you let the box handle the DNS for all the domains hosted on your box.

However, issues like this, except of course when they’re caused by bugs at Microsoft 😉 can occur if you’re sending mail through an external relay service, in which case you need to include their servers in the SPF record:

```dns
@ IN TXT "v=spf1 mx include:_spf.externalmail.com -all"

```

Or if you’re using external DNS and sending from a subdomain, in which case I’d say you need separate records for the subdomain, which should probably look something like this:

```dns
@ IN MX 10 box.domain.net.
subdomain IN MX 10 box.domain.tld.

@ IN TXT "v=spf1 mx -all"
subdomain IN TXT "v=spf1 mx -all"

dkim._domainkey IN TXT "v=DKIM1; k=rsa; p=MII..."
dkim._domainkey.subdomain IN TXT "v=DKIM1; k=rsa; p=MII..."

_dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@domain.tld"
_dmarc.subdomain IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@sub.domain.tld"

```

Or, of course, if you’re using external DNS and your MX record is set incorrectly, but then you would have other issues as well. 😉

---

<div class="post-metadata">

**Author:** ![miabuser12345](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/m/8dc957/32.png) [@miabuser12345](https://discourse.mailinabox.email/u/miabuser12345)\
**Post date:** [March 11, 2025, 4:19pm UTC](https://discourse.mailinabox.email/t/the-default-spf-record-fails-now-with-microsoft/12743/4 "2025-03-11T16:19:01Z")

</div>

thx guys, I am sending directly from the box and have box also in charge of the DNS.  
Sorry for omitting that.

So basically a bug on the MS side of things then. Makes sense because it just happened yesterday all of a sudden without any changes to the DNS.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.mailinabox.email/uploads/default/original/2X/4/4d0933d13c456b7e57f296aa6cc344525b6f0c70.png) [@system](https://discourse.mailinabox.email/u/system)\
**Post date:** [April 20, 2025, 4:19pm UTC](https://discourse.mailinabox.email/t/the-default-spf-record-fails-now-with-microsoft/12743/5 "2025-04-20T16:19:17Z")

</div>

This topic was automatically closed 40 days after the last reply. New replies are no longer allowed.