Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I understand the basics to setting up an SPF record in my zone files, on my DNS. And for the most part it seems easy enough to configure. However, I've been constantly testing my postfix server with simple PHP scripts, and sending emails to myself via smtp.

I've configured the spf to allow for my mail servers to be permitted. I've included the ip addresses, and now I've changed to domain names.

Here's what I've got:

@  IN TXT "v=spf1 a mx ~all"

When I relay thru google's mail servers I always get a neutral response:

"Received-SPF: neutral ( is neither permitted nor denied by best guess record for domain of client-ip="

"Authentication-Results:; spf=neutral ( is neither permitted nor denied by best guess record for domain of"

I get that from the "Show Original" option, inside my gmail account. It may be nothing, but I've been expecting something other than "is neither permitted nor denied by best guess", from google.

I see the same thing with qualified companies, with correct spf settings. And then I see places with a "pass".

Has anyone had any luck moving from "neutral" to "pass"?

share|improve this question
Sure. Always. Test your settings online But if you want us to check, then we need the concrete SPF and domain. – mailq Aug 19 '11 at 20:31
+1 for request for actual data. Why obscure this? It's in the DNS, which is about as publicly-visible as you get. Just tell us the domain so we can try to help. – MadHatter Aug 19 '11 at 21:07
up vote 4 down vote accepted

It's not recognizing the TXT record as valid SPF because of a typo, and falling back to the default of ?all.

Change v=sfp1 to v=spf1:

@  IN TXT "v=spf1 a mx ~all"
share|improve this answer
+1 copy-n-paste is your friend – Chris S Aug 19 '11 at 20:32
The typo was only on here, not in the zone file. I didn't want to include the entire thing, and ended up typing too fast. – user271619 Aug 19 '11 at 20:39
@user271619 Google's using "best guess" records, which means that they're either not able to retrieve, or not able to parse, your record. What do you get from nslookup -querytype=txt – Shane Madden Aug 19 '11 at 20:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.