Its not really an answer, but SPF is doing what its told.
Agreed.
So either you have to convince Xtra's mail to disable their rejections
(unlikely) or you have to get something into the customer's SPF record
to permit your hosts to send.
The domains with the hard fail SPFs are not my customers so I have no control over them at all.
The issue is people emailing from those domains to domains we do host and they are getting the bounce and blaming us. (perhaps rightly so, but this has only become an issue in the last week and even then for only 2 customers)
Dirty hack that won't work much is to IPv6-enable your mail relay. There
seem to be fewer restrictions on that side, at least google is a little
more accepting.
Already fully IPv6 enabled.
So it looks like I need to go back and have another look at SRS. It would seem that either few organisations hosting email are ���relaying��� like we do or have already implemented SRS. If that is the case, I���d be interested in knowing whether SRS creates its own set of problems.