SPF ends in ?all (neutral)
What this check looks for
Your SPF record ends by telling receivers to form no opinion about servers that are not on your list. The standard says receivers must treat that exactly like having no SPF record at all, so the record is not protecting you.
Why it matters
A neutral result gives a receiver nothing to act on, so forged mail from unlisted servers is not penalised.
When the check passes, your report says: “SPF ends in a rule receivers can act on, not a neutral one”.
What it costs your score
When this check fails it removes 10 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 10 points
- Family cap
- email-auth.spf · 35
- Category
- Email authentication
- Module
- Email spf
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Change ?all to ~all, and to -all once your sender list is confirmed complete.
Neutral is treated the same as having no SPF record, so the record is not protecting you.
Verify the record lists every service that sends as ‹domain›.
Replace
?allwith~all. Softfail marks unlisted senders without rejecting them, so this step does not by itself stop any mail being delivered.Watch DMARC aggregate reports for two weeks, then move to
-all. That step does cause receivers to reject unlisted senders, so only take it once the reports are clean.
How to confirm it worked
dig +short TXT ‹domain› — expect ~all or -all rather than ?all
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The record for ‹domain› ends in ?all. RFC 7208 §8.2 defines neutral as explicitly meaning the domain makes no assertion, and states it must be treated exactly like none. ?all is sometimes used during a migration; it should not be a permanent state.
Standards and references
- RFC 7208 §8.2 — Neutral § 8.2
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other email spf checks
- SPF authorises the whole internet through an address range
- SPF record lists the same sender twice
- SPF include chain contains a loop
- SPF include target has no SPF record
- SPF is close to the 10 DNS lookup limit
- More than one SPF record published
- SPF record has no all mechanism
- No SPF record published
- SPF authorises a very large block of addresses
- SPF ends in +all — anyone may send as your domain
- SPF uses the deprecated ptr mechanism
- SPF has both redirect= and an all mechanism