Skip to content
DomainGrade

What we checkEmailEM-02

Your SPF record ends in +all

+all authorises every server on the internet to send email as your domain.

Area
Email
Check
EM-02
Included
Free in every scan

What we check

Your SPF record ends with +all, which passes any sender.

Why it matters

It is worse than having no SPF record. No record leaves receivers uncertain; +all actively tells them the forgery is authorised.

It caps your grade at C on its own, because it turns your own anti-forgery record into a permission slip.

It also silently defeats DMARC. With +all, SPF passes for every sender, so a DMARC policy of p=reject never rejects anything — the record is published, the protection is not there, and nothing in either record looks wrong at a glance.

How to fix it

  1. 1

    Change +all to -all.

  2. 2

    Check the rest of the record still lists every legitimate sender before you do.

  3. 3

    Then check your DMARC policy. With +all in place, DMARC has been passing every message regardless of source, so its reports have told you nothing useful and are worth reading afresh.

The corrected record
yourcompany.com.  IN TXT  "v=spf1 include:_spf.google.com -all"

Common questions

How did this happen?
Almost always someone debugging a delivery problem who loosened the record to rule SPF out, and never tightened it again.
Is +all ever right?
No. There is no configuration in which authorising every server on the internet to send as your domain is the outcome you want — if you need to permit an unknown sender temporarily, add its include rather than opening the record.
What if mail breaks when I change it?
Then a sender is missing from the record — which was true before, you just could not see it. Use ~all briefly and read the DMARC reports.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other email checks