MediumPolicy · usually medium
SPF record ends with ?all
The record explicitly takes no position on unlisted senders.
Check your own domain
What causes this
?all is the neutral qualifier: it tells receivers that a sender which matched nothing in your record should be treated exactly as if you had published no SPF record at all. It is functionally close to having no policy, and it prevents SPF from contributing anything useful to a DMARC evaluation for unauthorised senders.
What it breaks
Unauthorised senders receive a neutral result rather than a failure, so SPF does not help receivers distinguish your mail from forgeries.
How to fix it
Change ?all to ~all, then to -all once you are confident the sender list is complete.
- Confirm the record lists every service that sends mail for the domain.
- Change ?all to ~all.
- After monitoring for a week with no legitimate failures, change it to -all.
Specification: RFC 7208 — Sender Policy Framework
Related problems
- BIMI record published without DMARC enforcementBIMI requires a DMARC policy of quarantine or reject. The record will be ignored.
- External reporting address is not authorisedReports are directed to another domain that has not published the required authorisation record.
- DMARC record requests no aggregate reportsThere is no rua address, so you receive no data about who sends as your domain.
- DMARC policy is set to noneThe policy monitors but does not act — failing mail is still delivered.
- Subdomain policy is weaker than the domain policysp= is set to a laxer value than p=, leaving subdomains less protected.