Finding: SPF Record Enforces a Hard Fail
This is an informational finding, not a problem. It means your domain publishes exactly one SPF record and it ends in -all — the strongest configuration SPF supports.
Last updated August 9, 2026.
What it means
Receiving mail servers that check your domain's SPF record will reject mail from any server not explicitly listed in it. -all is a hard fail: unlike ~all (soft fail, often still delivered to spam) or ?all/+all (little to no enforcement), a hard fail is the qualifier receivers actually act on with confidence.
Why it matters
Domain spoofing — sending mail that appears to come from your addresses — is the starting point for invoice fraud, payroll fraud, and phishing campaigns that borrow your brand's trust. A hard-fail SPF record removes the easiest version of that attack for any receiver that checks SPF.
What Nivaronix checks
Nivaronix performs a live TXT lookup on your domain, isolates the record beginning with v=spf1, and reads its final mechanism. This finding fires only when exactly one SPF record exists and it ends in -all.
Example evidence (illustrative — not live scan data)
TXT example.com: v=spf1 include:_spf.google.com include:sendgrid.net -all
Keeping it that way
- Add any new sending service's
include:to the record before it starts sending, not after mail starts failing. - Remove
include:entries for services you've stopped using — every entry still costs part of the 10-lookup budget. - Re-run a scan after any change to DNS or your email provider to confirm the record still resolves to a single, hard-fail policy.