What does “4.7.26 Access denied, a message sent over IPv6 [2a01:111:f200:2004::240] must pass either SPF or DKIM validation, this message is not signed” mean?
The message reached Microsoft over IPv6 and passed neither SPF nor DKIM.
Last read from the sources at the foot of this page.
Access denied, a message sent over IPv6 [2a01:111:f200:2004::240] must pass either SPF or DKIM validation, this message is not signed
What does it mean?
Microsoft accepts mail over IPv6 only when it passes SPF or DKIM. The address in the error is Microsoft's example; your bounce shows the real one.
What exactly does the source say?
4.7.26 Access denied, a message sent over IPv6 [2a01:111:f200:2004::240] must pass either SPF or DKIM validation, this message is not signed The sending message sent over IPv6 must pass either SPF or DKIM.
Why would a small firm see it?
A server or service sending over IPv6 that is not in SPF and does not sign.
How do I fix it?
- Turn on DKIM signing for your domain at your mail provider, and at each other service that sends as your domain.Each one gives you a record to publish.
- Publish each record exactly as the service shows it, at the name it gives, in your DNS host.
Keep one SPF record. Add the service inside the one record you have, before its last word, and keep every service already in it. A second SPF record makes the check fail for every message.
An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10 the check fails, so take out services you no longer use before adding a new one.
Where does this come from?
- Microsoft: Email non-delivery reports and SMTP errors in Exchange Onlinelearn.microsoft.comRead 14 October 2026
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/