Email piping stopped working

Has anyone seen this before, seems to have started recently.

We use Fluent Support with email piping. Mail arrives at my emailaddress say support@mydomain.com (Google Workspace) and is forwarded to our mailbox address whatever@fluent.support.

Any sender whose domain publishes a strict SPF record (-all) is rejected. Confirmed in our Google Workspace email log:

rejected by route2.mx.cloudflare.net [2606:4700:f5::e] — 550 5.7.1 2607:f8b0:4864:20::1148 isn't allowed to send email for theclient@theirdomain.com

The cause is standard SPF breakage on forwarding: the forwarding hop preserves the original envelope sender, so your Cloudflare inbound checks the sender's SPF record against a Google IP and rejects. The sender gets a bounce; we never see the ticket.