You will not get anywhere until you have log data from the rejecting organization. You need to see what they saw when they rejected the message.
One possibility (most likely):
- You allow users to enable automatic forwarding to an account outside your organization.
- You have not enabled the option on your domain to "Enable SRS when Forwarding messages"
- Therefore, messages that you forward are being blocked, not based on your domain, but based on the SPF policy of the originating domain.
Workaround:
If for some bizarre reason the problem really is your domain, change your SPF policy from -ALL to ?ALL, so that recipients will not reject on fail.
Preventing recurrence:
1) Enable DKIM signatures for each configured domain.
2) Publish a DMARC policy for each configured domain, including a reporting address, so that recipients look for and use the DKIM signature.
3) Look at the reports.
When you have these preventive measures in place:
- an SPF glitch will be forgiven because of the DKIM signature.
- A glitch with the DNS signature, such as DNS Temp Error, will be forgiven because of SPF PASS.
- Every day you will get reports from at least the major server farms, showing SPF and DKIM evaluation results from the previous day. This can help you chase down the problem instead of flying blind. (There are both free and paid services that can save you the trouble of building a report-processing environment. I use the free service from PostmarkApp.com, which only provides summaries. They have a paid service and an API for drill down, but I have built my own XML parsing tools.)
- Aside from all of these benefits, Google and AOL/Yahoo have said that having a DMARC policy is pretty much mandatory if you want delivery to their environment, effective Feb 1, 2024. For forwarded messages, you also need ARC, so you need to be on a recent release of SmarterMail that implements ARC. I don't think they are enforcing that mandate 100%, but you don't want to fall victim.
If you are hosting domains for customer organizations, you should be implementing DKIM signatures and DMARC policies as part of your standard setup. This helps to keep your IP address from being block-listed, and since a block list entry affects all of your domains, it should be avoided as much as possible.