Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=Sophos-Mailflow-SPF-failures-troubleshoot

Troubleshoot SPF failures

In Sophos Mailflow, your emails are routed from Microsoft to Sophos and back to Microsoft. With this routing behavior, Microsoft may sometimes fail the SPF check for your emails.

To fix this, add the Sophos SPF domain for your region to your SPF record. This authorizes Sophos to send email on behalf of your domain and helps Microsoft validate messages correctly.

To add Sophos as a permitted sender, update your SPF record using the include statement.

  • Existing SPF record:

    v=spf1 include:spf.protection.outlook.com -all

  • Updated SPF record:

    v=spf1 include:spf.protection.outlook.com include:<sophos-spf-domain> -all

Replace <sophos-spf-domain> with the SPF domain for your region. See Sophos SPF domains.

Example for the United States (West) region 
v=spf1 include:spf.protection.outlook.com include:_spf_uswest2.prod.hydra.sophos.com -all