SPF record has no all mechanism

MediumConfirmedQuick winemail.spf.no-all

What this check looks for

Your SPF record lists authorised senders but never says what to do about everyone else. Receivers treat unlisted senders as neutral, which gives them no reason to distrust a forgery.

Why it matters

An SPF record without a closing policy protects almost nothing: a forged message from an unlisted server gets a neutral result, which is treated much like having no record at all.

When the check passes, your report says: “SPF ends with an all mechanism covering everyone else”.

What it costs your score

When this check fails it removes 10 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.

It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.

Severity: medium
Default confidence: confirmed
Status when triggered: fail
Deduction: 10 points
Family cap: email-auth.spf · 35
Category: Email authentication
Module: Email spf
Fix owned by: dns host
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Add ~all to the end of the record, then tighten to -all.

Without a closing mechanism, mail from unlisted servers gets a neutral result and is not distrusted.

Confirm every legitimate sender is already listed.
Append ~all as the last mechanism in the record.
Move to -all after DMARC reports show no legitimate sender failing.

How to confirm it worked

dig +short TXT ‹domain› — expect the record to end in ~all or -all

The configuration to publish

v=spf1 {{existingMechanisms}} ~all

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

The record for ‹domain› contains no all mechanism and no redirect= modifier. Per RFC 7208 §4.7, an evaluation that reaches the end of the record without a match returns neutral, which is explicitly documented as being treated like none.

Standards and references

RFC 7208 §4.7 — Default Result § 4.7

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email spf checker Build the fix