MailFixIt

Cisco Secure Email setup

Cisco Secure Email: SPF fails for outbound mail

The SPF policy may not authorize the Cisco system that made the final public SMTP connection.

Problem description

The visible symptom is:

Authentication-Results: spf=fail smtp.mailfrom=example.com

Check the sending domain

Fix the SPF failure

  1. Read smtp.mailfrom, Return-Path, and the connecting IP from a failed message.
  2. Confirm whether that IP belongs to Cisco Cloud Gateway or your own appliance.
  3. For Cloud Gateway, use the SPF mechanism assigned to your allocation. Cisco documents an allocation-specific exists mechanism.
  4. For a managed appliance, authorize its actual public outbound IP or stable sending hostname.
  5. Merge the mechanism into the one SPF policy for the envelope domain, before the final all.
  6. Send a new message and confirm spf=pass for the same route.

Common causes

The policy was published at the wrong domain, the wrong cloud allocation was copied, a NAT address was omitted, or a second SPF record was created.

What the check proves

MailFixIt can expose public syntax, duplicate policies, DNS lookup failures, and unauthorized resolved addresses. It cannot prove which Cisco route sent a historical message.

Frequently asked questions

Which Cisco value belongs in SPF?

Cloud Gateway customers use the mechanism Cisco assigns to their allocation. Self-managed gateway owners authorize the public IPs or stable DNS names that actually send mail.

Should I copy a DNS value from another company?

No. Use the value shown for your own tenant, region, and mail route. Preserve every other service that still sends or receives mail.

Related email diagnostics

SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. SPF terms after all are ignoredDiagnose SPF includes and redirects placed after all. Find unreachable sender authorization, reorder the policy safely, and verify the result. Cisco Secure Email: inbound mail bypasses the gatewayFix inbound mail that bypasses Cisco Secure Email or stops after an MX routing change.

Primary sources: Cisco: Cloud Gateway configuration best practices.