auth.spf.plus_all
SPF +all (Open SPF)
What we check
We inspect the qualifier on the all mechanism at the end of the SPF record. The all mechanism matches every IP address, so its qualifier decides SPF's result for any sender not matched earlier. A + qualifier means pass.
What this finding means
The record ends in +all, which returns a pass for every server on the internet. Anyone, anywhere, is authorized to send mail as your domain — SPF protection is not merely weak, it is completely negated.
Why it matters
- Worse than no SPF. A missing record leaves the result neutral;
+allactively tells every receiver that all forgeries are authorized. It hands attackers a green light. - Total spoofing exposure. Phishing and spam sent as your domain pass SPF, and any DMARC policy that relies on SPF alignment passes with them.
- Almost always a mistake.
+allis occasionally pasted from a bad example or left over from testing. There is no legitimate reason for a production domain to publish it.
How to fix
Change
+allto-all(hardfail) once your authorized senders are listed, or~all(softfail) during rollout:example.com. IN TXT "v=spf1 include:_spf.your-provider.example -all"Confirm your legitimate senders are covered first. Before switching to
-all, make sure every server and service that sends as your domain appears viaip4:/ip6:/include:— otherwise their mail will start failing SPF.
How it's graded
+all carries a 40-point deduction and forces the Authentication category to an instant F, regardless of other findings. It is the single most damaging SPF misconfiguration. See Grading Methodology for the full scoring model.
Evidence example
$ dig +short TXT example.com
"v=spf1 include:_spf.your-provider.example +all"
^^^^ authorizes every server on the internet