>without a SPF record a domain don't have anything but SPF_NONE
Doesn't that depend on the HELO of the server? If they HELO'd with another name which does have a record it would explain it. (pure speculation, in your posts I didn't see where they HELO'd with, or I have missed it). SPF_HELO_PASS has nothing to do with the sending domain, but with the name the incoming mailserver identifies itself with HELO in the initial connection, (which can be really anything but should be valid and preferably their own hostname). Can you dig up the HELO/EHLO from your logfiles or from the headers of the mail in question? /MJ -----Oorspronkelijk bericht----- Van: Reindl Harald [mailto:h.rei...@thelounge.net] Verzonden: maandag 5 januari 2015 23:13 Aan: users@spamassassin.apache.org Onderwerp: Re: SPF_HELO_PASS,SPF_NONE