DIAGNOSTIC PLAYBOOK
SPF neutral: why the sender is neither approved nor denied
An SPF neutral result means the policy makes no assertion about the sending host. This can be intentional, but it is not an SPF pass and cannot supply the passing SPF authentication that DMARC needs.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Check the actual envelope domain rather than assuming the visible From domain was tested.
- Inspect whether a question-mark qualifier or an unmatched policy led to neutral.
- Ask the sending service for its required authorization and verify a new message after any approved update.
What this looks like
ILLUSTRATIVE EXAMPLE
A record ending in ?all produces neutral for an IP that matches no earlier mechanism. A separate aligned DKIM signature may still allow DMARC to pass.
A mistake to avoid
A neutral result is not proof of abuse. It says less than either a positive authorization or an explicit fail.
Keep the result in context
SPF evaluates the SMTP client against the envelope sender domain, or the HELO identity in the applicable case. A record lookup can identify publication problems; a message result also needs the actual sending IP and identity. Keep those inputs with your investigation.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.