Chasing SPF temperror in Exchange Online: DNS Timeouts, Mimecast SRS, and Getting Microsoft Engineering Involved
The Problem Inbound mail was intermittently producing spf=temperror results in Exchange Online despite a valid, RFC 7208-compliant SPF record and no delivery failures. Messages were accepted and delivered, so no NDRs, no user-visible symptoms, but authentication headers showed this: Authentication-Results: spf=temperror (sender IP is 209.85.128.197) smtp.mailfrom=yourdomain.com Received-SPF: TempError (protection.outlook.com: error in processing during lookup of yourdomain.com: DNS Timeout) External resolvers (Google (8.8.8.8), Cloudflare (1.1.1.1)), direct queries to the authoritative nameserver, all resolved the SPF record cleanly and consistently. The timeout was happening exclusively inside Exchange Online’s MTA infrastructure. ...