What "Received-SPF: softfail" means (and why mail still lands in spam)

You see this in headers rather than a bounce:

Received-SPF: softfail (domain of example.com does not
  designate 203.0.113.9 as permitted sender)

Softfail comes from a ~all at the end of your SPF record. It means "this source isn't listed, but don't reject it" — so receivers accept the mail but weigh it toward spam, and DMARC will treat SPF as not aligned/passing.

Why it happens

A sending source — a new ESP, a support desk, an invoicing tool, a server that changed IP — isn't included in your SPF record. The message goes out, the receiver checks SPF, finds the IP absent, and applies the softfail qualifier.

Diagnose it

Run the SPF check below: it expands every include: and shows the flattened set of authorized senders and the total DNS-lookup count. Compare the sending IP in the header against that set — if it's missing, that's your culprit.

Fix it

1. Add the missing source via its published include: (preferred) or an ip4:/ip6: range.

2. Keep the record under 10 DNS lookups — flatten includes if you're near the limit.

3. Once every legitimate source passes, tighten ~all to -all to hardfail spoofers.

4. Remember SPF breaks on forwarding — pair it with aligned DKIM so DMARC still passes.