The SPF check on SMG appears to be generating occasional temperror results:
spf=temperror [email protected] smtp.helo=smtp.example.com
Release : 10.8.0
The SPF temperror means that the Messaging Gateway MTA was temporarily unable to look up the sending domain's SPF record in the DNS. This may be due to a query timeout or the configured DNS server applying a rate limit to Messaging Gateway.
The SPF temperror represents a transient failure but if they are commonly seen in the SMG message audit logs the DNS servers set in Administration > Configuration > host > DNS / Time should be investigated to ensure that they are operating as expected and are not applying rate limits to the SMG system.
By default, SMG will not take action on an SPF temperror but a custom content policy can be configured to track or take action on messages which receive a temperror.