MediumAuthentication · usually medium
SPF record has mechanisms after the all term
Terms placed after all are never evaluated.
Check your own domain
What causes this
SPF is evaluated left to right and the all mechanism always matches. Anything after it is dead configuration: a receiver reaches all, returns its result, and never looks further. This usually happens when a new include is appended to the end of an existing record instead of being inserted before the all term.
What it breaks
The sending services listed after all are not authorised, even though the record appears to include them. Their mail fails SPF.
How to fix it
Move every mechanism to before the all term.
- Take the mechanisms currently sitting after all.
- Reinsert them before the all term, keeping their order.
- Ensure all is the final term in the record.
Specification: RFC 7208 — Sender Policy Framework
Related problems
- No DKIM key found at the selectors we checkedWe probed the selectors used by common providers and found no DKIM record.
- DKIM record is malformedThe record at this selector is not a valid DKIM key record.
- DKIM key is shorter than 1024 bitsThe RSA key is too short to be considered secure and some receivers reject it.
- No DMARC record foundThere is no DMARC policy at _dmarc for this domain.
- DMARC record contains a syntax errorA tag in the DMARC record is malformed, which can invalidate the whole policy.