Can any one know about this? I get a soft fail from an IP address which isn't one of the whitelisted IP Marketo addresses. It isn't one from my company. Any ideas?
That's a Trend Micro hosted mail scanning (i.e. security gateway) IP.
At a glance, it looks like they tried to resend the email after scanning, using the original envelope sender. That'll naturally (soft)fail SPF because they're not authorized to use the envelope domain @potomac1050.mktomail.com.
Non-transparent mail forwarders like this must rewrite the envelope sender in light of SPF. This is a misconfiguration in the Trend service.
Elizabeth DeLange please return to this thread and mark my answer as Correct.