Messages can be blocked because of an SPF issue either by the filtering server or by the destination mail server.
You can tell that the message was blocked by the filtering server if the message appears Rejected in the log search. This means that the sender’s SPF did not include the IP where the message arrived from. Usually, the sender would need to resolve this issue by adding all the relevant IPs in the SPF record. If this is not possible, then you can always add the sending domain to the Manage list of domains and IP addresses with disabled SPF, DKIM, and DMARC checks. This will ensure that the SPF check will be skipped for that particular domain.
If the message was blocked by the destination mail server, then it will appear as Accepted in the Log Search. Usually, this happens because the SPF check is enabled on the destination mail server. As the final hop in delivery is the filtering server, this means that the message will appear to be coming from an IP, one of the filtering server, which is not included in the sender’s SPF. And it shouldn’t be. To resolve this, the SPF check should be disabled on the destination mail server, as this is already being performed during filtering. Alternatively, you should ensure that nothing on the destination mail server is blocking the connection from the filtering server IPs which are listed on the NOC page.
When outgoing filter is being used and you see a bounce related to the SPF failing, this will always be rejected by the destination mail server and not by the outgoing filter. Most likely this is because the SPF of the sending domain is not including the IPs of the filtering server. For more details on how to adjust the SPF when the outgoing filter is used, please see our article here.