dotvitals

SPF authorises a very large block of addresses

MediumConfirmedemail.spf.overly-broad-range

What this check looks for

Your SPF record authorises a huge range of internet addresses to send mail as you. Anyone who can get a server in that range — including other customers of the same provider — can pass your SPF checks.

Why it matters

SPF only helps if the list of authorised senders is small enough to be meaningful. A /8 covers sixteen million addresses; authorising it is close to authorising anyone.

When the check passes, your report says: “Authorised address ranges are narrow enough to mean something”.

What it costs your score

When this check fails it removes 6 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.

It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.

Severity
medium
Default confidence
confirmed
Status when triggered
warn
Deduction
6 points
Family cap
email-auth.spf · 35
Category
Email authentication
Module
Email spf
Fix owned by
dns host
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Narrow the range to the addresses that actually send your mail.

A broad range lets unrelated hosts pass authentication as your domain.

  1. Establish which addresses genuinely send mail for you — DMARC aggregate reports list them.

  2. Replace ‹mechanism› with those addresses, or with the provider's own include: if they publish one.

  3. If you truly need a range, prefer the narrowest prefix your provider will commit to.

How to confirm it worked

  • dig +short TXT ‹domain› — confirm the record no longer contains ‹mechanism›

  • Check a week of DMARC aggregate reports for sources you did not expect.

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

‹domain› authorises ‹mechanism›, which covers ‹address count› addresses. RFC 7208 §5.6 defines the ip4/ip6 mechanisms without any width limit, so this is legal but rarely intended: the usual cause is a copied example, a provider's whole allocation pasted in place of the sending range, or a /8 typed where a /32 was meant. Mail from any host in the range will pass SPF and, with a relaxed aspf, can also pass DMARC alignment.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email spf checkerBuild the fix

Other email spf checks