DirectMX will reject messages that come from a domain that has SPF configured, and the email does not match the SPF settings. This generally only happens if the sending domain's SPF record has a "-all" in it, indicating that the SPF record listed is the ONLY source of email to accept. If they have a "~all", and the email does not match the specified record, then we add some points to it and process as usual.
If a user would like to still receive email that is the first scenario -- completely doesn't match the SPF record, hard fail -- then there are settings to allow this.
S-915 Ignore sender whitelist on SPF fail/softfail
These settings can be found in Preferences->Stream Settings if you desire to change this behavior.
