spf=neutral

spf=neutral means the receiver found an SPF record for the bounce-address domain, evaluated it, and the record explicitly declined to say whether the sending IP is allowed. It is neither a pass nor a fail. For deciding whether to trust a message, it carries no information.

What the RFC says

RFC 7208 §2.6.2 defines neutral as the domain owner stating that it is not asserting whether the IP is authorized. §8.2 adds a firm rule: receivers must treat neutral exactly like none. The two values exist only so you can tell "no record" apart from "record that shrugs". The reasoning is that punishing neutral would discourage domain owners from publishing a cautious record while they test.

Where a neutral comes from

There are three routes, and the record usually shows which one applies:

• ?all at the end. The ? qualifier means neutral (§4.6.2), so a record like v=spf1 include:mailer.example.net ?all passes the listed service and returns neutral for everyone else.
• No all and no redirect. If nothing in the record matches, the default result is neutral, as if ?all were written at the end (§4.7). A record that only lists a couple of IPs and stops returns neutral for every other server.
• A receiver's guess. Some receivers, Gmail among them, have reported neutral against a "best guess record" when the domain published no SPF at all. That is the receiver's own heuristic, not anything the domain published, so it carries even less weight than a real neutral.

Authentication-Results: mx.example.org;
       spf=neutral (192.0.2.15 is neither permitted nor denied by domain of
       alerts@example.com) smtp.mailfrom=alerts@example.com;
       dkim=pass header.d=example.com;
       dmarc=pass header.from=example.com

If you received this message

Ignore the SPF line and look at DKIM and DMARC. Here, an aligned DKIM signature carried DMARC to a pass, so the From domain is authenticated. If DKIM is missing too, nothing on the message authenticates the sender, and the analyser will flag it as unauthenticated.

If you own the domain

A neutral result on your own mail means the record isn't doing its job. List every service that sends with your bounce domain, then end the record with ~all or -all. If you used ?all on purpose during a rollout, let DMARC aggregate reports confirm that every source passes before you tighten it. The SPF guide walks through building the record.