- (Fail): SPF Qualifier
The SPF - qualifier (Fail) causes a hard fail when a mechanism matches. The receiving server should reject the message.
Published · Last verified · Maintained by TamingDNS
Qualifier
No (no extra lookup)
💬 What This Qualifier Does
The "-" qualifier produces a "Fail" result. When used as "-all" at the end of a record, it tells receiving servers to reject any mail not covered by earlier mechanisms. This is the strongest SPF enforcement level and is required for full DMARC-aligned protection.
When to Use This
- "-all", recommended ending for mature SPF records where all senders are known
- "-ip4:203.0.113.0/24", explicitly block a specific IP range
⚠️ Watch Out For
- Don't use "-all" until you're confident your SPF record covers every legitimate sender.
- Legitimate forwarded mail (mailing lists, aliases) will fail SPF hard. Consider DMARC alignment.
📋 Complete Example Records
Every one of these is a complete record you can paste as it stands. Try one in the SPF Checker or build your own with the SPF Builder.
v=spf1 include:_spf.google.com -all
The end state you are aiming for. Google sends, nobody else does, and receivers are told to reject the rest.
v=spf1 -all
A domain that never sends mail. Parked domains, brand-protection registrations and anything that only hosts a website want this.
v=spf1 -ip4:192.0.2.13 ip4:192.0.2.0/24 -all
Carves one address out of a range. Order is what makes it work: mechanisms are read left to right and the first match wins, so put the exclusion first.
v=spf1 ip4:192.0.2.0/24 -ip4:192.0.2.13 -all
The same two terms the wrong way round. The /24 matches first and 192.0.2.13 passes, so the exclusion never runs.
📚 RFC References
🔗 Related SPF Elements
🔧 Related Tools
Check whether your current SPF record is valid and covers all your senders, or move on to the DKIM and DMARC side of the same job.