SPF failures
Decision-tree troubleshooting guide for envelope sender domain does not authorize the source ip in PowerMTA environments.
Review before production. Adapt hostnames, IPs, credentials, paths and limits to your licensed PowerMTA release and validate syntax in a staging environment.
Symptom
Envelope sender domain does not authorize the source IP.
First response: Review return-path domain, SPF include chain, DNS lookup count and actual sending IP.
Decision tree
Start: Envelope sender domain does not authorize the source IP
↓
1. Contain risk and preserve logs
↓
2. Identify scope by VMTA, authenticated user, provider and time
↓
3. Compare with last known-good configuration and baseline
↓
4. Apply one reversible correction
↓
5. Validate with controlled traffic and accounting logs
Evidence to collect
- Exact timestamp and timezone
- Authenticated username or submission source
- Envelope sender and recipient domain
- Selected VMTA, source IP and HELO
- SMTP response and enhanced status code
- Relevant accounting and service-log records
- Last configuration change
Safe corrective sequence
- Pause only the affected stream when possible.
- Preserve the original response and configuration.
- Reproduce with one controlled test.
- Apply the smallest reversible change.
- Verify queue behavior and document the outcome.
Avoid
- Deleting queues before preserving evidence.
- Changing many directives simultaneously.
- Rotating source identities to bypass reputation controls.
- Assuming every temporary error is a rate problem.