SPF record ends with +all
The record authorises the entire internet to send mail as this domain.
Check your own domain
What causes this
The all mechanism is the catch-all at the end of an SPF record, and its qualifier decides what happens to senders that matched nothing earlier. +all means 'pass' — every server on the internet is declared an authorised sender for your domain. This is almost always a mistake made while debugging, where the qualifier was loosened to stop failures and never tightened again.
What it breaks
SPF provides no protection at all. Anyone can send mail claiming to be your domain and it will pass SPF. Worse, it can pass DMARC too, because a forged message that passes SPF with alignment satisfies DMARC.
How to fix it
Replace +all with ~all, or -all once the sender list is confirmed complete.
- Confirm every legitimate sending service is listed in the record.
- Change +all to ~all (soft fail).
- Monitor DMARC reports or re-check for a week to confirm no legitimate sender is failing.
- Tighten ~all to -all for a hard fail.
Specification: RFC 7208 — Sender Policy Framework
Related problems
- BIMI record published without DMARC enforcementBIMI requires a DMARC policy of quarantine or reject. The record will be ignored.
- External reporting address is not authorisedReports are directed to another domain that has not published the required authorisation record.
- DMARC record requests no aggregate reportsThere is no rua address, so you receive no data about who sends as your domain.
- DMARC policy is set to noneThe policy monitors but does not act — failing mail is still delivered.
- Subdomain policy is weaker than the domain policysp= is set to a laxer value than p=, leaving subdomains less protected.