Email Authentication
SPF policy strength check
The ending of your SPF record (-all, ~all, ?all or +all) decides what receivers do with mail from servers you did not list.
Check this on your own domain now. It is free with a DomainGuard account and works on any domain. The check reads only what your domain publishes, and gives you a report you can send to whoever runs your website.
What we look at
We read the all mechanism at the end of your SPF record. ~all (soft fail) and -all (hard fail) both pass: they tell receivers that servers you did not list are not yours. ?all (neutral) is a warning because it says nothing, and +all fails because it authorizes everyone.
Why it matters to your business
An SPF record that ends in ?all or +all lists your servers and then tells receivers it does not matter if mail comes from somewhere else, which gives an impersonator exactly what they need. We recommend ~all: with DMARC in place the receiver acts on your DMARC policy, and a soft fail is gentler on forwarded mail and on a sender you have not listed yet. -all is valid too.
How to fix it
- Once your SPF record lists every service that sends for you, end it with ~all, and publish a DMARC policy so receivers know what to do with mail that fails.
- Never use +all (or a bare all). It authorizes the entire internet to send as your domain.
If you would rather not touch DNS or server settings yourself, forward this page and your report to whoever manages your website, or ask us to do it.
Keep an eye on it
A one-off check tells you how things stand today. On Starter and up, DomainGuard re-checks the domains it watches every day and alerts you in the app when something important changes, so you hear about it before a customer does.