Incoming emails marked as SPAM because of SPF fail on them


If you are using ServiceNow relay and a user sends an email to the instance, those emails are audited. Some of them could be marked as SPAM.

If the email is marked as spam, the header of the email contains 'X-ServiceNow-Spam-Status: Yes'.

X-ServiceNow-Spam-Status:Yes, score=6.887 tagged_above=-999 required=6.2
tests=[BAYES_00=-1.9, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001,


Your ServiceNow email relay system uses SpamAssassin to determine if an email is a spam by assigning points based on several spam tests.

SPF checks factor heavily into a mail’s spam score.  In order to be flagged as spam, a message must have an aggregate score of 6.2 or higher. A soft SPF failure will add 3.5 to the score, whereas a hard SPF failure will add 7.0 to the score, immediately flagging it as spam. It is recommended to check and ensure that your company’s SPF records are correct and up-to-date, or some messages may be inadvertently marked as spam.


The best solution would be for the email domain they are using to update their SPF records. The sender should let their email admin know and that they need to have an up to date SPF record for the domain they are using so that the emails sent from their domain do not fail SPF checks.

ServiceNow cannot accommodate individual suggestions on the scoring algorithm on the ServiceNow email system. If the spam scoring is not working as required for your company, turn off any filtering of the scored emails within the Email Filters on the instance.

Below is the Email Filter "Move spam to junk folder", which considers the headers. You will need to add the conditions based on the information of those emails you want to allow-list, based on the information found on the header, subject, etc.

Please note that dynamic email servers (e.g. Unix, Linux email servers) that are not registered on your company SPF record, will generate a soft SPF failure. In those cases, please ensure to set the emails as clients to an SPF registered email relay server. Alternatively, update the instance Email Filter conditions to allow those relays based on the information on the email header.

Additional Information

More general information about our Email Spam Scoring and Filtering: KB0549426