The all mechanism is the last rule in an SPF record and sets the default for senders not otherwise matched: -all hardfail (reject), ~all softfail (accept but mark), ?all neutral (no opinion), +all pass everything (never use). For production, use ~all while building and -all once your record is complete.
-all — hardfail: unlisted senders fail SPF; receivers should reject. ~all — softfail: unlisted senders are accepted but flagged. ?all — neutral: no assertion, essentially no protection. +all — pass: authorizes the entire internet to send as you; a severe misconfiguration.
Start with ~all so you don’t bounce a legitimate sender you forgot to list. Watch your DMARC reports; once every real sender passes, move to -all for the strongest SPF stance. Never ship ?all or +all.
Check your SPF record now
Open the free SPF checker →-all is stronger. With DMARC enforcing, ~all is still well protected, but -all adds defence in depth once your record is complete.
You authorize anyone to send as your domain — it effectively disables SPF protection. Remove it immediately.
