spf neutral verdict wrongly quarantined by exchange mail filter error

TL;DR

SPF neutral, the ?all result, means the domain makes no assertion about that sender. It is not a failure and should not by itself quarantine mail. When Exchange quarantines on neutral, a custom transport rule, an anti-phishing setting, or an over-broad SCL assignment is usually treating neutral as hostile. Find which component stamped the quarantine decision and narrow it.

spf neutral verdict wrongly quarantined by exchange mail filter error

Use this when

• Message trace shows quarantine with spf=neutral in the headers.
• Senders from domains publishing ?all are consistently quarantined for one tenant.

Not for this skill when

• Mail fails SPF with -all and is quarantined. That is the sender policy working as written.
• Quarantine is driven by malware or high-confidence phish verdicts unrelated to SPF.

Steps

1. Pick a quarantined message and read its headers for the verdict that drove quarantine, including SCL and any rule IDs in the trace. Verify: the deciding component is identified, not assumed to be SPF.
2. Search transport rules and anti-phishing policies for conditions matching SPF results or neutral authentication states. Verify: any rule treating neutral as fail is located.
3. Check whether the sending domain publishes ?all deliberately, for example a domain that does not send mail should publish -all instead. Verify: the correct sender-side fix, if any, is distinguished from your tenant-side fix.
4. Narrow your rule: act on SPF fail, or on neutral combined with other risk signals, rather than neutral alone. Verify: the edited rule no longer matches neutral-only legitimate mail.
5. Release a test message from an affected sender and trace it. Verify: it delivers without quarantine while SPF fail test mail is still caught.

Variant phrasings

exchange quarantines spf neutral legitimate mail

The tenant-side variant.

spf question mark all neutral meaning receiver handling

The record-meaning variant.

Compatibility: Microsoft Exchange Online Protection, RFC 7208 result definitions.

Why it happens

Neutral exists for domains that cannot enumerate their senders. Some tenants wrote rules during early SPF adoption that collapsed neutral, softfail and fail into one bad bucket, and those rules now punish cautious senders.

Edge cases / pitfalls

• Softfail is also not fail, though many policies legitimately score it. Keep the three results distinct in rules.
• If the sender domain truly never sends mail, ask the owner to move from ?all to -all rather than weakening your filter.
• Document any exception by sender domain and purpose so the narrowed rule does not regrow.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_crAmbFJ0vW1t9ooOKkP9hg