SPF authorises a very large block of addresses
What this check looks for
Your SPF record authorises a huge range of internet addresses to send mail as you. Anyone who can get a server in that range — including other customers of the same provider — can pass your SPF checks.
Why it matters
SPF only helps if the list of authorised senders is small enough to be meaningful. A /8 covers sixteen million addresses; authorising it is close to authorising anyone.
When the check passes, your report says: “Authorised address ranges are narrow enough to mean something”.
What it costs your score
When this check fails it removes 6 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 6 points
- Family cap
- email-auth.spf · 35
- Category
- Email authentication
- Module
- Email spf
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Narrow the range to the addresses that actually send your mail.
A broad range lets unrelated hosts pass authentication as your domain.
Establish which addresses genuinely send mail for you — DMARC aggregate reports list them.
Replace
‹mechanism›with those addresses, or with the provider's owninclude:if they publish one.If you truly need a range, prefer the narrowest prefix your provider will commit to.
How to confirm it worked
dig +short TXT ‹domain› — confirm the record no longer contains ‹mechanism›
Check a week of DMARC aggregate reports for sources you did not expect.
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
‹domain› authorises ‹mechanism›, which covers ‹address count› addresses. RFC 7208 §5.6 defines the ip4/ip6 mechanisms without any width limit, so this is legal but rarely intended: the usual cause is a copied example, a provider's whole allocation pasted in place of the sending range, or a /8 typed where a /32 was meant. Mail from any host in the range will pass SPF and, with a relaxed aspf, can also pass DMARC alignment.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other email spf checks
- SPF authorises the whole internet through an address range
- SPF record lists the same sender twice
- SPF include chain contains a loop
- SPF include target has no SPF record
- SPF is close to the 10 DNS lookup limit
- More than one SPF record published
- SPF record has no all mechanism
- No SPF record published
- SPF ends in +all — anyone may send as your domain
- SPF uses the deprecated ptr mechanism
- SPF ends in ?all (neutral)
- SPF has both redirect= and an all mechanism