SPF Neutral (?all)

Your SPF record ends in `?all`, which explicitly tells receivers 'no opinion' on unauthorized senders.

Impact — Low impact

Neutral is the weakest SPF signal possible. Mail is more likely to be filtered than ?all users expect, because receivers treat 'no opinion' as 'low confidence' — not neutral.

What causes it

You configured ?all intentionally during testing and forgot to tighten it.
A default SPF generator used ?all because the user picked 'least strict' option.
A migration script copied ?all from an older template.

How to fix it

Step 1: Decide the correct policy

For almost every domain, -all (hard fail) is correct. Use ~all (soft fail) only during the initial deployment week while you confirm all senders. Never leave ?all in production.

Step 2: Audit your senders first

Before switching to -all, make sure every legitimate sender is covered. Use DMARC rua reports to catch anything you missed.

Step 3: Update the record

Edit your DNS SPF TXT record, change ?all to -all (or ~all if you want a brief soft rollout), and verify with dig.

Fixed it? Run a fresh test to confirm.

Test my inbox →