What is it?
This mail deliverability finding means SPF returned a softfail result, usually because the sending IP matched ~all or another soft-failing SPF mechanism. It means the sender is probably not authorized, but the domain has not requested a hard fail.
Why does it matter?
Receivers often treat softfail as suspicious. It can reduce inbox placement and may prevent DMARC from passing unless DKIM is valid and aligned with the Header From domain.
How to fix it?
Add the legitimate sending IP or provider include to the domain SPF record, and remove obsolete includes for old providers.
example.com. 3600 IN TXT "v=spf1 ip4:203.0.113.10 include:_spf.provider.example -all"Keep only one SPF TXT record. After confirming all legitimate senders are covered, use -all for a stricter policy.