SPF record has no all mechanism
Updated
Fewer than 1% of the 793 domains we could check fail this. Sample: the first 1,000 domains by rank in the Majestic Million, checked on 2026-10-12. How we measured
What this check looks for
Your SPF record lists authorised senders but never says what to do about everyone else. Receivers treat unlisted senders as neutral, which gives them no reason to distrust a forgery.
Why it matters
An SPF record without a closing policy protects almost nothing: a forged message from an unlisted server gets a neutral result, which is treated much like having no record at all.
When the check passes, your report says: “SPF ends with an all mechanism covering everyone else”.
What it costs your score
When this check fails it removes 10 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 10 points
- Family cap
- email-auth.spf · 35
- Category
- Email authentication
- Module
- Email spf
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Add ~all to the end of the record, then tighten to -all.
Without a closing mechanism, mail from unlisted servers gets a neutral result and is not distrusted.
Confirm every legitimate sender is already listed.
Append
~allas the last mechanism in the record.Move to
-allafter DMARC reports show no legitimate sender failing.
How to confirm it worked
dig +short TXT ‹domain› — expect the record to end in ~all or -all
v=spf1 {{existingMechanisms}} ~allA named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The record for ‹domain› contains no all mechanism and no redirect= modifier. Per RFC 7208 §4.7, an evaluation that reaches the end of the record without a match returns neutral, which is explicitly documented as being treated like none.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.