What SPF mechanism indicates that a domain should send no mail?

Sender Policy Framework (SPF) is a crucial email authentication standard that helps protect your domain from being used for phishing and spam. It works by specifying which mail servers are authorized to send email on behalf of your domain. But what if a domain isn't supposed to send any email at all? There's a specific SPF mechanism designed for exactly this scenario.

SiteGround says:

Visit website

A Sender Policy Framework (SPF) is a DNS record, part of a domain's DNS zone, that declares which domains and hosts can or cannot send emails on behalf of a domain...

The short answer is that the mechanism -all is used in an SPF record to indicate that a domain sends no mail. When a receiving mail server sees this, it knows that any email claiming to be from your domain is unauthorized and should be rejected.

Suped DMARC monitor

Free forever, no credit card required

Get started for free

Trusted by teams securing millions of inboxes

To fully understand this, we need to look at how an SPF record is structured. An SPF record consists of the version prefix (v=spf1) followed by one or more mechanisms. As Kinsta explains, mechanisms define the IP addresses authorized to send emails from the domain. The all mechanism is a special catch-all that always matches. It's used at the end of the record to tell receiving servers what to do with emails from senders that did not match any of the preceding mechanisms.

Search Security says:

Visit website

Mechanisms are the techniques SPF can use to verify that a specified domain is authorized to send email. A mechanism is said to match if some aspect of the SMTP transaction matches the criteria of the mechanism.

The real power comes from the qualifier that precedes the all mechanism.

A qualifier tells the receiving server how to treat a match. There are four possible qualifiers:

• + (Pass): The sender is authorized. This is the default if no qualifier is specified.
• ? (Neutral): The SPF record makes no statement on whether the IP is authorized. The email is treated as if there is no SPF record.
• ~ (SoftFail): The sender is likely not authorized. The message should be accepted but marked as suspicious.
• - (Fail): The sender is not authorized. The email should be rejected. This is also known as a HardFail.

DuoCircle says:

Visit website

If an email receives SPF hardfail as a status, it means that its sender's email address is explicitly not permitted to send emails using the domain.

To create an SPF record indicating no email should be sent, you combine the all mechanism with the - (Fail) qualifier. You don't need any other mechanisms because you aren't authorizing any senders. The resulting record is simple and powerful:

v=spf1 -all

By publishing this as a TXT record in your domain's DNS, you are making a clear statement. You're telling the world's mail servers that no IP address is authorized to send email for this domain. This is an essential security measure for domains that are parked, used for internal services only, or are simply not intended for sending email. It effectively stops phishers and spammers from spoofing your domain, protecting your brand's reputation.

In summary, the SPF mechanism to indicate a domain should send no mail is -all. By creating an SPF record with the value v=spf1 -all, you instruct receiving servers to reject any email that claims to come from your domain. This simple step is a highly effective way to prevent domain spoofing and enhance your overall email security posture for non-sending domains.