R1 — Known sender, SPF fail, alignment OK

Triggers when: a source IP matched by the known-senders allowlist (and not already recognized as a known forwarder, which is R12's case instead) shows SPF failing while there's no accompanying SPF alignment problem — i.e. the sender is legitimate but its SPF setup for this specific path needs attention.

What to do: check whether this sending platform is included in your SPF record (include:) — a missing or stale include is the most common cause. Low severity because DKIM is typically still covering the message.