SPF "all" mechanism
The SPF mechanism that always matches; placed last in a record, its qualifier sets the result for every address the earlier terms did not authorize.
What it means
all is the catch-all at the end of an SPF record. Because it matches any IP address, terms after it are never read, and RFC 7208 says a redirect modifier is ignored whenever all appears anywhere in the record. What matters is the qualifier in front of it: -all (fail), ~all (softfail), ?all (neutral) or +all (pass).
A record with no all and no redirect ends with an implicit ?all, so unlisted senders get neutral. RFC 7208 says ending explicitly is better anyway, because it aids debugging.
The choice between -all and ~all is the main policy decision in SPF. Under DMARC it matters less than it looks: DMARC needs an aligned pass from SPF or DKIM, and a softfail or fail counts the same way, as no SPF pass.
Example
v=spf1 include:_spf.example.net -allRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 7208: Sender Policy Framework (SPF), section 5.1rfc-editor.org
- RFC 7208: Sender Policy Framework (SPF), section 4.7rfc-editor.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes