all: SPF Mechanism
The SPF all mechanism matches every sender not covered by earlier mechanisms. The qualifier (-all, ~all, +all) determines how unmatched senders are treated.
Published · Last verified · Maintained by TamingDNS
Mechanism
[qualifier]all
No (no extra lookup)
-all
💬 What This Mechanism Does
The "all" mechanism always matches and is always placed at the very end of an SPF record. Its qualifier determines what happens to any sender that didn't match any earlier mechanism: "-all" rejects them (hard fail), "~all" soft-fails (marks as suspicious), "?all" is neutral (pass with no opinion), and "+all" passes everyone, effectively disabling SPF.
When to Use This
- "-all", strict: reject all unlisted senders (recommended for mature records)
- "~all", permissive: soft-fail unlisted senders (good during rollout/testing)
- "?all", neutral: used during initial SPF setup or troubleshooting
⚠️ Watch Out For
- "+all" makes your SPF record useless. Never use it.
- DMARC requires at least "~all" or "-all" to be effective; "?all" weakens DMARC enforcement.
- The "all" mechanism MUST be last; any mechanisms after it are ignored.
📋 Complete Example Records
Every one of these is a complete record you can paste as it stands. Try one in the SPF Checker or build your own with the SPF Builder.
v=spf1 a mx -all
Anything that is not one of the domain's own addresses or MX hosts fails outright. RFC 7208 §5.1 uses this record as its example.
v=spf1 include:_spf.google.com ~all
The softfail ending, and the right one while you are still finding out who sends as your domain.
v=spf1 -all
For a domain that sends no mail at all, there are no mechanisms to match, so every sender fails. Pair it with a null MX record.
v=spf1 -all include:_spf.google.com
This validates cleanly and still authorises nobody. Everything after "all" MUST be ignored, so the include is dead text.
📚 RFC References
🔧 Related Tools
Check whether your current SPF record is valid and covers all your senders, or move on to the DKIM and DMARC side of the same job.