dotvitals

SPF ends in +all — anyone may send as your domain

CriticalConfirmedQuick winemail.spf.plus-all

What this check looks for

Your SPF record explicitly authorises every server on the internet to send mail as your domain. This is worse than having no SPF record at all, because it tells receivers the forgery is legitimate.

Why it matters

Spoofed invoices and phishing sent from your domain will pass SPF and can pass DMARC, arriving with your reputation attached.

When the check passes, your report says: “SPF withholds authorisation from senders it does not list”.

What it costs your score

When this check fails it removes 35 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.

It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.

Severity
critical
Default confidence
confirmed
Status when triggered
fail
Deduction
35 points
Family cap
email-auth.spf · 35
Category
Email authentication
Module
Email spf
Fix owned by
dns host
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Replace +all with ~all now, then move to -all once you have confirmed your senders.

+all authorises the entire internet to send as you and actively assists spoofing.

  1. Change the final mechanism from +all to ~all.

  2. Confirm every legitimate sender is listed in the record.

  3. After two weeks of clean DMARC reports, change ~all to -all.

How to confirm it worked

  • dig +short TXT ‹domain› — the record must not contain +all or a bare all

The configuration to publish
v=spf1 {{existingMechanisms}} ~all

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

The record for ‹domain› ends in +all (or a bare all, which defaults to +). RFC 7208 §5.1 defines all as always matching, so a + qualifier returns pass for every sender. There is no legitimate configuration that requires this.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email spf checkerBuild the fix

Other email spf checks