spf=none

spf=none means the SPF check had nothing to work with. Either the domain in the bounce address publishes no SPF record, or the receiver could not get a valid domain name to look up at all. No verdict was reached about the sending server, good or bad.

What the RFC says

RFC 7208 §2.6.1 gives two causes: no usable domain could be taken from the SMTP session, or the DNS returned no SPF record. §8.1 describes the outcome as the verifier having no information at all. The lookup rules give the details: a domain that does not exist in DNS returns none right away (§4.3), and so does a TXT lookup that turns up nothing starting with exactly v=spf1 (§4.5).

Common causes

1. The domain never set up SPF. Small organizations, personal domains, and the HELO names of many servers have no record.
2. A bounce or auto-reply. Delivery-failure notices have an empty envelope sender. SPF then checks the sending server's HELO name instead (§2.4), and many server hostnames have no SPF record.
3. A typo in the record. v=spf1 must be exact. A record starting v=spf 1, v=SPF1 with a stray character, or v=spf10 is discarded and counts as no record.
4. The domain does not exist. If the bounce domain returns NXDOMAIN, the result is none, and that is itself a strong spam signal.

Return-Path: <>
Authentication-Results: mx.example.org;
       spf=none smtp.helo=relay7.example.net;
       dkim=none;
       dmarc=none header.from=example.net

Not the same as dmarc=none

The two "none" values are independent. spf=none is about the bounce domain's SPF record. dmarc=none means the From domain publishes no DMARC record. A domain can have one without the other. Also, spf=none is not the same as spf=neutral, even though receivers must treat the two alike: neutral means a record exists but takes no position.

If you received this message

None is not an accusation. Plenty of legitimate mail, bounces especially, arrives this way. But it means SPF can't help you, so check the DKIM result. When nothing at all authenticates a message that claims to be from a bank or a large company, be suspicious: those senders always authenticate.

If you own the domain

Publish one TXT record at the domain that sends your mail (and at the custom bounce subdomain, if you use one), listing your sending services. For a domain that never sends email, publish v=spf1 -all, which tells receivers to refuse anything claiming to be from it. The Return-Path guide explains which domain SPF actually checks.