The last part of an SPF record says how receivers should treat a server that is not on your list. The symbol before 'all' makes the difference.
The sender is not allowed. Receivers may reject the message or mark it strongly as suspicious. The ending sits at the very end of the record, after all other entries.
The sender is probably not allowed. Receivers usually accept the message but treat it with suspicion, for example by flagging it.
?all (neutral) makes no statement either way. +all allows every server in the world, which defeats the purpose of SPF and should not appear in a real record.
The receiver decides what to do with an SPF result, and DMARC adds your policy on top. A softfail on its own is a gentle signal; with a strict DMARC policy, the outcome can be firmer.
DNS Domain Detective shows the ending of your SPF record along with the rest of your mail setup. Open DNS Domain Detective
DNS Domain Detective is now available on the App Store.
Last reviewed: 2026-11-02
#DNS #DKIM #SPF #DMARC #EmailSecurity #SysAdmin #MSP #iOS
This page gives general information and is not legal, financial or medical advice. [email protected]