-all
The SPF ending that returns fail for any IP address the record does not authorize, the strictest statement a domain can make in SPF.
What it means
-all tells receivers that the listed sources are the only legitimate ones and that anything else is not authorized. Receivers decide what to do with a fail; RFC 7208 says one that rejects during the SMTP session should use a 550 reply with enhanced code 5.7.1.
That strictness has a cost when a legitimate source is missing from the record or when mail is forwarded, since the forwarder's IP address is not listed. Before switching from ~all to -all, check DMARC aggregate reports for sources that still fail.
For a domain that sends no mail at all, v=spf1 -all is the standard protective record. Outlook.com refuses mail from a domain whose record authorizes no one, which catches domains that start sending without updating it.
Example
v=spf1 include:_spf.example.net -allRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 7208: Sender Policy Framework (SPF), section 8.4rfc-editor.org
- RFC 7208: Sender Policy Framework (SPF), section 4.6.2rfc-editor.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes