I prefer g_spf_mode "block".  Too much other stuff goes on when you use 
strict like guessing if the ip is "close enough".  Block means if it 
doesn't match it's blocked.  And that works 100% for us.

--Ed

On 07/22/2016 01:19 PM, Paul M. Beck wrote:
> SurgeMail Version 7.1f-46, Built Apr 18 2016 22:14:07, Platform OSX_intel (Surgeweb Enabled)
>
> g_spf_mode = Strict
>
> nothing to allow bypass that I can find.
>
>
> Why/How did the server let this through?
>
> Received-SPF: fail (Last token {-all} (res=FAIL)) client-ip=193.111.173.72; envelope-from=<gsxHIDDEN@cations@apple.com>; x-ip-name=mailgw1.minjust.gov.ua;
> Received: from mailgw1.minjust.gov.ua (unverified [193.111.173.72])
> 	by bexx.net (SurgeMail 7.1f) with ESMTP id 1985473-1724755
> 	for HIDDEN@n@bexx.com>; Fri, 22 Jul 2016 09:26:16 -0600
> Return-Path: <gsxHIDDEN@cations@apple.com>
> Received: from postfix1.minjust.gov.ua (unknown [192.168.40.31])
> 	by mailgw1.minjust.gov.ua (Postfix) with ESMTP id 5198228ECCD
> 	for HIDDEN@n@bexx.com>; Fri, 22 Jul 2016 15:58:14 +0300 (EEST)
> Received: from SanaSamIR (unknown [197.27.2.106])
> 	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
> 	(No client certificate requested)
> 	by postfix1.minjust.gov.ua (Postfix) with ESMTPSA id 96B50C0F0D
> 	for HIDDEN@n@bexx.com>; Fri, 22 Jul 2016 15:58:13 +0300 (EEST)
> Message-ID: <03aa0116$42573HIDDEN@36781713@sanasamir>
> From: "Global Service Exchange" <gsxHIDDEN@cations@apple.com>
> To:HIDDEN@n@bexx.com
> Subject: Your GSX access request has been approved.
> Date: Fri, 22 Jul 2016 14:58:10 +0200
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
> 	boundary="9Sdwjq5TPIcw280oQsx=_1HTSnzO1jGULK"
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Mailer: planet
> X-MimeOLE: hi
> X-Originating-IP: 193.111.173.72
> X-Country: code=UA country="Ukraine" ip=193.111.173.72
> X-ORBS-Accept: dnswl_medium
> X-IsFriend: <gsxHIDDEN@cations@apple.com>
> X-Rcpt-To: HIDDEN@n@bexx.com>
> X-FriendScore: **********: 10.1 sd=10.1 Close nspam=1 nok=0 1.00  0.95(spf_failed) 0.10(dnswl_medium) 0.90(X-Country:Ukraine) $0.80(X-Phrase:isspam) 0.20(X-myrbl:Color=yellow) 0.68(X-Verify-MX present) 0.65(Extremely high tags-to-te) $0.35(X-Verify-Helo:+OK) $0.50(X-LangGuess:English) SanScore 9.0 10.1
> X-NakedCr: Body contained naked cr characters
> X-LangGuess: English
> X-Probe: +OK skipped, from friend
> X-Phrase: IsSpam score=1.00
> X-Verify-Helo: +OK mailgw1.minjust.gov.ua
> X-Verify-MX: <gsxHIDDEN@cations@apple.com> senders ip (ch=193.111.173.72 msg=193.111.173.72, net=193.111.) not in mx data dom=apple.com ipname=mailgw1.minjust.gov.ua (17.151.62.67 17.151.62.68 17.151.62.66 1)
> X-MyRbl: Color=Yellow Age=0 Spam=0 Notspam=0 Stars=0 Good=0 Friend=2 Surbl=0 Catch=0 r=0 ip=193.111.173.72
> X-IP-stats: Incoming Last 0, First 0, in=1, out=0, spam=0 ip=193.111.173.72
>
>
>
>

-- 
-----------------------------------------------------------
EAS Enterprises LLC
World Class Web and Email Hosting Solutions
IPv6 ready today for your needs of tomorrow!
Ask us about dual-stacking your site
www.easent.net