auth.spf.neutral_all

SPF Neutral Policy (?all)

What we check

We read the qualifier in front of the SPF record's final all mechanism. ?all (neutral) is the value this finding reports.

What this finding means

Neutral means the domain explicitly declines to say whether an unlisted server may send its mail. RFC 7208 §2.6.2 tells receivers to treat a neutral result exactly like none: the record lists some senders, but a message from anywhere else is neither authorized nor unauthorized. For anyone forging your domain, ?all is as good as no SPF record at all.

Why it matters

• Nothing is rejected. A ?all record cannot produce an SPF fail, so it never contributes to blocking forged mail.
• DMARC gets no help. SPF alignment can only pass; it can never fail on its own, so DMARC enforcement rests entirely on DKIM.
• It usually signals an unfinished rollout. ?all is what a record looks like when someone wanted to publish SPF "without breaking anything" and never came back.

How to fix

1. List every legitimate sender (your mail platform, newsletter tool, ticket system, CRM) using include:, ip4:/ip6: or mx.

2. Replace ?all with a softfail while you watch the aggregate reports, then a hard fail:

   copy

   example.com.  IN  TXT  "v=spf1 include:_spf.provider.example ~all"
   example.com.  IN  TXT  "v=spf1 include:_spf.provider.example -all"
   

3. Re-scan. The finding clears once the record ends in ~all or -all.

How it's graded

Not scored — this finding carries no point deduction in the current model; the Grading page lists it under "Findings without a deduction". See Grading Methodology for the full scoring model.