You made me go back and check the email I had in mind. I'm not sure to be honest. What I do see is that it soft-failed SPF: > Authentication-Results: mx.google

You made me go back and check the email I had in mind. I'm not sure to be honest. What I do see is that it soft-failed SPF: > Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning {user@domain} does not designate {IP} as permitted sender) So I guess you can use that to blame the domain owner, but I feel like the fact that it was a reply to my own email should've been enough to allow it through? Moreover, there are other emails around that time that weren't replies but still softfailed SPF, and they were still let through.