Finding: SPF Record Provides No Protection
This finding means your domain publishes an SPF record, but its final mechanism is +all (explicitly authorizes every server) or ?all (neutral — no judgement). The record exists, so the domain looks protected on a checklist, but it stops nobody from spoofing your address.
Last updated August 11, 2026.
What it means
+all tells receivers that every server on the internet is authorized to send mail as this domain — the opposite of what SPF is for. ?all tells receivers to make no judgement at all about unlisted senders. Either way, the record itself gives receivers nothing to act on.
Why it matters
This is a common false sense of security: an SPF record is present, so monitoring tools and quick manual checks that only look for "does an SPF record exist" report the domain as fine. In practice, a domain at +all or ?all gets no meaningful protection from spoofing at all — functionally similar to publishing no SPF record, just disguised as a passing check.
What Nivaronix checks
Nivaronix performs a live TXT lookup, isolates the single record beginning with v=spf1, and reads its final mechanism. This finding fires when that mechanism is +all or ?all.
Example evidence (illustrative — not live scan data)
TXT example.com: v=spf1 include:_spf.google.com ?all
How to fix it
- List every legitimate service that sends email for this domain, confirming they're already covered by an
include:orip4:/ip6:mechanism. - Edit the TXT record at your DNS host and replace the trailing
+allor?allwith-all. - If you're unsure every sender is listed yet, use
~allfirst while you confirm, then move to-all.
How to verify the fix
Re-run the SPF & DMARC checker and confirm it now reports the record ending in -all.