Finding: SPF Record Enforces a Hard Fail
This is an informational finding, not a problem. It means your domain publishes exactly one SPF record and it ends in -all — the strongest configuration SPF supports.
Last updated August 9, 2026.
What it means
Receiving mail servers that check your domain's SPF record will reject mail from any server not explicitly listed in it. -all is a hard fail: unlike ~all (soft fail, often still delivered to spam) or ?all/+all (little to no enforcement), a hard fail is the qualifier receivers actually act on with confidence.
Why it matters
Domain spoofing — sending mail that appears to come from your addresses — is the starting point for invoice fraud, payroll fraud, and phishing campaigns that borrow your brand's trust. A hard-fail SPF record removes the easiest version of that attack for any receiver that checks SPF.
What Nivaronix checks
Nivaronix performs a live TXT lookup on your domain, isolates the record beginning with v=spf1, and reads its final mechanism. This finding fires only when exactly one SPF record exists and it ends in -all.
Example evidence (illustrative — not live scan data)
TXT example.com: v=spf1 include:_spf.google.com include:sendgrid.net -all
Keeping it that way
- Add any new sending service's
include:to the record before it starts sending, not after mail starts failing. - Remove
include:entries for services you've stopped using — every entry still costs part of the 10-lookup budget. - Re-run a scan after any change to DNS or your email provider to confirm the record still resolves to a single, hard-fail policy.
Related
FAQ
Do I need to do anything if this finding is showing?
No — this is an informational finding that confirms your SPF record is already at its strongest setting. It exists to document that the check ran and passed, not to prompt a fix; the action item is only to keep the record accurate as sending services change.
Can a hard-fail SPF record still let spoofed mail through?
Yes, in two ways: not every receiving mail server checks SPF, and SPF alone doesn't stop look-alike domains (a different domain entirely, not a spoof of yours). DMARC, which builds on SPF and DKIM together, is what makes a hard-fail policy actually enforceable at scale across receivers rather than optional per-receiver.
Why -all instead of ~all if -all is stricter?
-all is the correct end state, but ~all is the recommended starting point while you confirm every legitimate sender is included — a premature -all can silently reject real mail from a sender you forgot to list. Once reports confirm every sender passes, moving to -all is what closes the gap for good, which is exactly the state this finding is confirming.
Does adding a new email service break this once I have -all set?
Only if you forget to add its include: mechanism to the record before it starts sending — mail from an unlisted sender will hard-fail at any receiver enforcing SPF. Add the new service's include: to the record first, then start sending from it, not the other way around.