Our Return-Path header (AKA: envelope sender) is lists.bettermail.ca which is the address that is being verified by SPF records.

smtpX.mailsender04.com is the name for some of our SMTP servers, this however is not being verified by SPF records.

Our SPF records for bettermail.ca allow sending from all of our IP ranges.

See the following sample SPF pass header from Gmail for example.

  spf=pass (google.com: domain of xxx-xxxxx-xxxxx@lists.bettermail.ca designates 216.105.95.193 as permitted sender) smtp.mail=xxx-xxxxx-xxxxx@lists.bettermail.ca

  

The problem with some forwarded emails is that the destination still checks the SPF records of the original sender (our Return-Path header).

Since the IPs of the forwarding server are not in our SPF records it will be rejected by the destination server due to our SPF policy which was previously set to a hard fail "-all".

This really is not a problem with the SPF records but how the forwarding is done. 

Please see http://www.openspf.org/SRS or http://en.wikipedia.org/wiki/Sender_Rewriting_Scheme for help in implementing the Sender Rewriting Scheme.

Our SPF records will allow forwarded messages to be classified as a soft SPF fail instead of the original hard SPF fail.

Did this answer your question?