spf=none

What spf=none means

spf=none means the receiver looked up the SPF record for the envelope sender's domain and found none. Either the domain has no TXT record starting with v=spf1, or the domain itself doesn't exist in DNS. It is not a failure, but it isn't a pass either: the receiver has no way to tell whether the sending server was allowed, and DMARC can't use SPF for that message.

Authentication-Results: mx.google.com;
       spf=none (google.com: mail.example.com does not designate permitted sender hosts) smtp.mailfrom=mail.example.com;
       dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=example.com

Check which domain was looked up

SPF checks the envelope sender (MAIL FROM, shown as Return-Path and smtp.mailfrom), not the From address the reader sees. These are often different. In the sample, the From is example.com, which may well have an SPF record, but the bounce address is on mail.example.com, which doesn't. When the envelope sender is empty (bounces and auto-replies), receivers check the HELO name instead, shown as smtp.helo.

Open the message's headers in the Email Header Analyzer and read the domain in smtp.mailfrom before changing anything.

Common causes

• The domain never had an SPF record. Common for new domains and for domains set up only for a website.
• A subdomain is used as the envelope sender. SPF records don't inherit, so bounce.example.com needs its own.
• Server-generated mail from a web server or cron uses the machine's hostname, such as web1.example.com, as the envelope sender.
• The record was published with a typo, for example v=spf1 missing or v=spf 1, so it isn't recognized as SPF.
• The record is on the wrong name, such as _spf.example.com or www.example.com instead of example.com.

How to fix it

Publish one TXT record on the exact domain from smtp.mailfrom, listing every service that sends with it:

example.com.  TXT  "v=spf1 include:_spf.google.com ~all"

Use the include your provider documents. A few common ones:

For a subdomain used only as a return-path by an email service, the service usually tells you to create a CNAME instead, which brings its SPF record along.

For domains and subdomains that never send mail, publish a record that allows nobody:

www.example.com.  TXT  "v=spf1 -all"

Only publish one SPF record per name (multiple records). After adding it, check it from outside with dig +short TXT example.com and send a test message to see spf=pass.

Does spf=none matter if DKIM passes?

For DMARC, one aligned pass is enough, so a message with aligned dkim=pass still passes DMARC with spf=none. Gmail and Yahoo expect senders to have both SPF and DKIM set up, though, and some spam filters score the missing record. Publishing it is cheap.

Related

• SPF softfail vs fail: what to put at the end of the record.
• SPF too many DNS lookups: keeping the record valid as it grows.
• dkim=none: the DKIM equivalent of a missing record.
• SPF record: full syntax.

Check whether a domain publishes SPF with the SPF Checker.