+ (Pass): SPF Qualifier
The SPF + qualifier (Pass) is the default result when a mechanism matches. The sending IP is authorised to send email for the domain.
Published · Last verified · Maintained by TamingDNS
Qualifier
No (no extra lookup)
💬 What This Qualifier Does
The "+" qualifier is the default. You almost never need to write it explicitly. When a mechanism with "+" (or no qualifier, which defaults to "+") matches, the result is Pass: the sender is authorised. "+all" means every sender passes, effectively disabling SPF enforcement.
When to Use This
- Implicit in every mechanism that has no qualifier prefix
- "a" and "mx" with no qualifier default to "+a" and "+mx"
⚠️ Watch Out For
- "+all" is dangerous. It passes every sender, making SPF pointless.
📋 Complete Example Records
Every one of these is a complete record you can paste as it stands. Try one in the SPF Checker or build your own with the SPF Builder.
v=spf1 +mx +ip4:192.0.2.0/24 -all
This spells out every "+". It is valid SPF, and almost nobody writes it out.
v=spf1 mx ip4:192.0.2.0/24 -all
The same record with the plus signs left off. Identical behaviour, because a mechanism with no qualifier defaults to "+".
v=spf1 +all
Every sender on the internet passes SPF for this domain. Finding it in production means someone has switched SPF off.
v=spf1 include:_spf.google.com +all
The same problem hiding behind a real include. The include looks like it is doing work, but "+all" passes everything it did not match.
📚 RFC References
🔗 Related SPF Elements
🔧 Related Tools
Check whether your current SPF record is valid and covers all your senders, or move on to the DKIM and DMARC side of the same job.