SPF ends with +all or ?all (too permissive)

What it means

An SPF record lists the servers allowed to send email for your domain, and ends with a rule for all other servers. That last part is the all mechanism, and the symbol before it decides what happens:

• -all (fail): other servers are not allowed.
• ~all (soft fail): other servers are suspicious.
• ?all (neutral): no opinion about other servers.
• +all (pass), or just all: every server in the world is allowed.

For example, this record looks fine at first sight but authorises everyone:

v=spf1 include:_spf.google.com +all

Why it matters

• With +all, a spammer's server passes SPF for your domain. Your record no longer protects you, and receivers see it as a sign of careless setup.
• With ?all, SPF gives no useful result for unknown servers, so it adds nothing against spoofing.
• Some spam filters add points to emails from domains with these endings.

These endings are usually added "to make things work" when an email was failing SPF. The real fix is to list the missing sender.

How to check

Scan your domain at /domain-scanner to see your SPF record. Or send a test email to your address on the home page (/): the SPF section shows the record used.

How to fix it

1. List every service that sends email for you: your mailbox provider, newsletter tool, online shop, CRM, invoicing tool, website contact form, your own servers.
2. Make sure each one is in the record, with the include: value from its help pages or an ip4: for your own server.
3. Replace the ending at your DNS provider. Edit the existing TXT record; do not create a second SPF record.

Safe starting point:

v=spf1 include:_spf.google.com include:spf.newsletter-example.com ~all

Once you are sure the list is complete:

v=spf1 include:_spf.google.com include:spf.newsletter-example.com -all

Which one to choose?

• ~all is a good choice while you are still finding all your senders, and works well with DMARC.
• -all is the strictest. Use it once your DMARC reports show that all your real senders pass.
• For a domain that never sends email: v=spf1 -all.

Watch for problems after the change

If a forgotten service was relying on +all, its emails will now fail SPF. DMARC aggregate reports are the easiest way to spot it: they show every IP sending with your domain and whether it passed. The paid dashboard's DMARC monitoring reads these reports for you.

Check that it is fixed

Wait for DNS to update, usually a few minutes to a few hours. Run /domain-scanner again: the record should end with ~all or -all. Then send a test from each of your sending services to the home page address and check that SPF still passes for all of them.