To me, it looks like oasystems.co.nz are relaying through gunge.hosts.net.nz (210.48.108.215) and this is not reflected in the published SPF record. For the SPF record to be valid, there needs to be an ip4:210.48.108.215 entry added.
No. OA Systems MTA only sends mail direct. It appears that safegas.co.nz have their mail configured to come via hosts.net.nz, and their on-premise mail server is enforcing SPF which should break for anyone sending them email.
MX records for domain safegas.co.nz Your 1 MX records are: 10 mta.hosts.net.nz ip=210.48.108.65
-----Original Message----- From: Martin Wilkinson [mailto:Martin(a)wilko.org] Sent: Thursday, 22 July 2010 4:22 p.m. To: Regan Murphy; Jasper Bryant-Greene; pid(a)ifm.net.nz Cc: nznog(a)list.waikato.ac.nz Subject: RE: [nznog] SPF Mail rejection Hi All, Bear in mind that MX records are used to work out where mail should be sent to, and does not necessarily reflect where it is coming from and the SPF records are to verify that messages are coming from an authorised source. If the sending host happens to be the same as the receiving host, the "v=spf1 a mx ptr -all" record makes sense, but if they are relaying through their ISP, they'll need to add the relay hosts to that record. To me, it looks like oasystems.co.nz are relaying through gunge.hosts.net.nz (210.48.108.215) and this is not reflected in the published SPF record. For the SPF record to be valid, there needs to be an ip4:210.48.108.215 entry added.