Skip to content
DomainGrade

What we checkEmailEM-03

SPF enforcement

The all mechanism at the end of your SPF record decides what happens to mail nobody authorised.

Area
Email
Check
EM-03
Included
Free in every scan

What we check

We read the final mechanism of your SPF record and its qualifier.

A redirect= to another domain's policy counts as configured, and we say so — we do not follow it and claim to have verified what it contains.

Why it matters

SPF without an enforcing all is a list of who may send, with no statement about anyone else. Receivers are left to guess, and most of them guess generously.

There is a second reason to enforce: DMARC can only act on an SPF result of fail, which is what -all produces. A record ending in ?all or with no all at all gives DMARC nothing to reject on, so a policy of p=reject quietly does less than it appears to.

How to fix it

  1. 1

    End the record with -all once you are confident every legitimate sender is listed.

  2. 2

    If you are still finding senders, use ~all and read your DMARC aggregate reports for a few weeks first.

Common questions

Will -all break my email?
Only for senders you have not listed. That is the point — but it is also why you should turn on DMARC reporting first and read a fortnight of it before tightening.
What about ?all?
It means 'no opinion', which is the same as having no policy. Receivers treat it as neutral, so it provides no protection at all.
My record ends in redirect=. Is that fine?
It is valid — your policy is whatever that domain publishes. We report it as configured rather than verified, because the answer lives somewhere you may not control.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other email checks