Strange SPF verification on inbound mail

Strange SPF verification on inbound mail

I am currently looking into an issue with a talktalk customer sending mail to another ISP

As part of a test I got her to send a mail to my zoho account using my personal domain timothydutton.co.uk

The header made for interesting reading.  It appears to show the Senders IP being verified against the SPF record, rather than the talktalk smtp server IP

Received-SPF: Neutral (zoho.com: 78.150.xxx.xxx is neither permitted nor denied by domain of xxxxxxx@talktalk.net ) client-ip: 78.150.xxx.xxx Delivered-To: xxx@timothydutton.co.uk Return-Path: <xxxxxx@talktalk.net> Received: from smtp.talktalk.net (wmsmtp.opaltelecom.net [62.24.128.253]) by mx.zohomail.com with SMTPS id 1398043685525594.7075089772342; Sun, 20 Apr 2014 18:28:05 -0700 (PDT) Received: from host-78-150-21-61.as13285.net (HELO Silverstone) ([78.150.xxx.xxx]) by smtp.talktalk.net with ESMTP/TLS/AES128-SHA; 21 Apr 2014 02:28:01 +0100 X-SMTPAUTH: pruemcl@talktalk.net X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: At0GALpzVFNOlhU9/2dsb2JhbABYgkJET8RhgR8XdIIlAQEFCAIeBSkwAwIGAw4DBAEBFggKBxkGGg0JCAIEEwsFiB0DFQHMSBeMSYE3EAIBVQEGBIQuBI8ORo9bjA6DMjyBNYEw X-IPAS-Result: At0GALpzVFNOlhU9/2dsb2JhbABYgkJET8RhgR8XdIIlAQEFCAIeBSkwAwIGAw4DBAEBFggKBxkGGg0JCAIEEwsFiB0DFQHMSBeMSYE3EAIBVQEGBIQuBI8ORo9bjA6DMjyBNYEw X-IronPort-AV: E=Sophos;i="4.97,894,1389744000"; d="scan'208,217";a="781500197" From: "xxxxxxxxxx" <xxxxxxx@talktalk.net> To: "'xxxxxxxxxx'" <xxx@timothydutton.co.uk> References: <002501cf5cf9$0498d250$0dca76f0$@talktalk.net> <53547275.2080605@timothydutton.co.uk> In-Reply-To: <53547275.2080605@timothydutton.co.uk> Subject: RE: TT to recipient's domain name Date: Mon, 21 Apr 2014 02:27:58 +0100 Message-ID: <003801cf5d00$ee229260$ca67b720$@talktalk.net> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0039_01CF5D09.4FE796A0" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKtVzyaqwqxGT1xzliQAOE6gE0T+QKafXoRmUp/ArA= Content-Language: en-gb X-ZohoMail: SS_1 SFPD SFPN PIC UW SF_705FHP_EXT SGR1_1_03044_162 X-ZohoMail-Owner: <003801cf5d00$ee229260$ca67b720$@talktalk.net>+zmo_0_<pruemcl@talktalk.net> X-ZohoMail-Sender: 78.150.xxx.xxx X-Zoho-Virus-Status: 2 

The cc to my virginmedia.com account the spf record is checked against the talktalk server address.
Authentication-Results: mx.google.com; spf=neutral (google.com: 62.24.128.253 is neither permitted nor denied by domain of pruemcl@talktalk.net) smtp.mail=xxxxxxxx@talktalk.net

However it still comes back as neutral despite appearing to be in a valid range
Does anyone have any ideas why this appears to be happening?

If I send a test from my blueyonder account it verifies the SPF record against VM's mail relays correctly.

Ravenstar68