in my company I have the following error.

softfail (google.com: domain of transitioning [email protected] does not designate X.X.X.X as permitted sender) client-ip=X.X.X.X;

Let's say my mail.company.com server is Y.Y.Y.Y, every user connects to his/her mail account from Thunderbird, the SMTP/POP3/IMAP is served by DirectAdmin hosted on Y.Y.Y.Y domain. Some of users who uses GMail to download mails from external POP3 server (mail.company.com) are receiving the above error and email is in SPAM directory. The SPF record which I had was:

v=spf1 a mx ip4:Y.Y.Y.Y ~all

The thing which I don't understand is how is it possible that IP marked as designated IP is X.X.X.X and it differs sometimes but still it's not SMTP server's ip Y.Y.Y.Y? I changed SPF record to:

v=spf1 mx a ptr ~all

But I don't this it's the best solution. I have my domain stored behind cloudflare but mail.company.com is not proxied only company.com is proxied. Thank you for any help.

  • 2
    Because that's where the mail came from. If you didn't expect mail to be sent from those IP addresses, you need to investigate why it is happening. Commented Nov 21, 2020 at 20:04
  • Sure bot how is it possible if email was sent using company's SMTP server and I see user settings in Thudebird that are set for the company's server?
    – Adam
    Commented Nov 22, 2020 at 0:18
  • We have no way of knowing the context here. It is your company! Commented Nov 22, 2020 at 1:07
  • The problem is the designated IP X.X.X.X is client's ip not not SMTP server's ip Y.Y.Y.Y.
    – Adam
    Commented Nov 22, 2020 at 16:36
  • Then you need to go look at that machine and figure out what it is doing. Commented Nov 22, 2020 at 16:40

1 Answer 1


I solved this by setting custom received header in exim config (/etc/exim.conf). In above file I've added:

received_header_text = ${if def:authenticated_id {Received: from $primary_hostname ([X.X.X.X] helo=[s1.example.com]) by $primary_hostname with ESMTP\n\t(Exim $version_number)\n\t${if def:sender_address {(envelope-from <$sender_address>)\n\t}}id $message_exim_id${if def:received_for {\n\tfor $received_for}}\n\t}}Received: ${if def:sender_rcvhost {from $sender_rcvhost\n\t}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)\n\t}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} ${if def:tls_cipher {($tls_cipher)\n\t}}(Exim $version_number)\n\t${if def:sender_address {(envelope-from <$sender_address>)\n\t}}id $message_exim_id${if def:received_for {\n\tfor $received_for}}

where X.X.X.X is mail server IP and s1.example.com is mail server hostname or ip address. I've put that after:

# primary_hostname =
smtp_active_hostname = ${if exists{/etc/virtual/helo_data}{${lookup{$interface_address}iplsearch{/etc/virtual/helo_data}{$value}{$primary_hostname}}}{$primary_hostname}}

After that I've restarted exim:

service exim restart

And now Google is not failing spam checks due to SPF SOFTFAIL.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .