SPF ends in +all — anyone may send as your domain
Updated
None of the 793 domains we could check fail this. Sample: the first 1,000 domains by rank in the Majestic Million, checked on 2026-10-12. How we measured
What this check looks for
Your SPF record explicitly authorises every server on the internet to send mail as your domain. This is worse than having no SPF record at all, because it tells receivers the forgery is legitimate.
Why it matters
Spoofed invoices and phishing sent from your domain will pass SPF and can pass DMARC, arriving with your reputation attached.
When the check passes, your report says: “SPF withholds authorisation from senders it does not list”.
What it costs your score
When this check fails it removes 35 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- critical
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 35 points
- Family cap
- email-auth.spf · 35
- Category
- Email authentication
- Module
- Email spf
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Replace +all with ~all now, then move to -all once you have confirmed your senders.
+all authorises the entire internet to send as you and actively assists spoofing.
Change the final mechanism from
+allto~all.Confirm every legitimate sender is listed in the record.
After two weeks of clean DMARC reports, change
~allto-all.
How to confirm it worked
dig +short TXT ‹domain› — the record must not contain +all or a bare all
v=spf1 {{existingMechanisms}} ~allA named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The record for ‹domain› ends in +all (or a bare all, which defaults to +). RFC 7208 §5.1 defines all as always matching, so a + qualifier returns pass for every sender. There is no legitimate configuration that requires this.
Standards and references
- RFC 7208 §5.1 — "all" § 5.1
- RFC 7208 §4.6.2 — Mechanisms § 4.6.2
Test this on your domain
Run the check that produces this finding, on its own, against any domain.