What is it?
This mail deliverability finding means the inbound sender IP is not authorized by the SPF policy of the visible From: domain. Standard SPF is evaluated against the envelope sender (MAIL FROM), but checking the Header From domain directly is useful when debugging brand-domain authorization.
Why does it matter?
Receivers and users see the Header From domain. If that domain does not authorize the sending host, the message may fail local policy checks, look suspicious, or depend entirely on DKIM for DMARC alignment.
How to fix it?
Add the legitimate sending server IP or provider include to the SPF TXT record for the visible From: domain.
example.com. 3600 IN TXT "v=spf1 ip4:203.0.113.10 include:_spf.provider.example -all"Keep only one SPF TXT record per domain. Confirm the sender IP in the report is the real public outbound SMTP host, and use aligned DKIM as a second DMARC path when possible.