SPF authorises a very large block of addresses
Updated
3% of the 793 domains we could check get a warning for this. Sample: the first 1,000 domains by rank in the Majestic Million, checked on 2026-10-12. How we measured
What this check looks for
Your SPF record authorises a huge range of internet addresses to send mail as you. Anyone who can get a server in that range — including other customers of the same provider — can pass your SPF checks.
Why it matters
SPF only helps if the list of authorised senders is small enough to be meaningful. A /8 covers sixteen million addresses; authorising it is close to authorising anyone.
When the check passes, your report says: “Authorised address ranges are narrow enough to mean something”.
What it costs your score
When this check fails it removes 6 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 6 points
- Family cap
- email-auth.spf · 35
- Category
- Email authentication
- Module
- Email spf
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Narrow the range to the addresses that actually send your mail.
A broad range lets unrelated hosts pass authentication as your domain.
Establish which addresses genuinely send mail for you — DMARC aggregate reports list them.
Replace
‹mechanism›with those addresses, or with the provider's owninclude:if they publish one.If you truly need a range, prefer the narrowest prefix your provider will commit to.
How to confirm it worked
dig +short TXT ‹domain› — confirm the record no longer contains ‹mechanism›
Check a week of DMARC aggregate reports for sources you did not expect.
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
‹domain› authorises ‹mechanism›, which covers ‹address count› addresses. RFC 7208 §5.6 defines the ip4/ip6 mechanisms without any width limit, so this is legal but rarely intended: the usual cause is a copied example, a provider's whole allocation pasted in place of the sending range, or a /8 typed where a /32 was meant. Mail from any host in the range will pass SPF and, with a relaxed aspf, can also pass DMARC alignment.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.