Defaults.Exposed › October 2026 census › v10 registry › SPF record
SPF record
Methodology v10 · canonical ID spf-exists · Email Security · scored
Stops criminals sending email that looks like it's from you, and helps your mail reach the inbox.
SPF record: definition
| Canonical ID | spf-exists |
|---|---|
| Category | Email Security |
| Grade impact | Scored, counts toward the grade |
| Pass | The domain publishes exactly one syntactically valid SPF (Sender Policy Framework) TXT (Text) record (v=spf1 …). |
| Fail | No SPF record is published, or the published record does not parse. |
| Example (passing) | v=spf1 include:_spf.google.com -all |
SPF record across the census
46.3% of graded domains publish an SPF record that ends in an all mechanism (-all, ~all, ?all or +all) (153,819,856 of 332,492,319, as of October 12, 2026).
A further 3,245,715 graded domains publish an SPF record with no terminal all mechanism, usually a redirect= or include-only record, which can be perfectly valid. The census evidence cannot separate a record that fails to parse from these, so this figure is not a count of syntactically valid records.
Aggregates only: never an individual domain's result.
How this check is scored
SPF record is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, every graded domain had a determinable result for this check.
Every outcome in the census
| Outcome | Domains | Share of graded domains | In the headline figure |
|---|---|---|---|
| SPF record ending in -all (hardfail) | 61,408,709 | 18.5% | Yes |
| SPF record ending in ~all (softfail) | 87,173,390 | 26.2% | Yes |
| SPF record ending in ?all (neutral) | 5,196,769 | 1.56% | Yes |
| SPF record ending in +all (permits any sender) | 40,988 | 0.01% | Yes |
| SPF record with no terminal all mechanism | 3,245,715 | 0.98% | No |
| No SPF record | 175,426,748 | 52.8% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
By top-level domain
This splits the share of graded domains that publish an SPF record that ends in an all mechanism (-all, ~all, ?all or +all) by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 353 TLDs, 234,547,634 domains | 43.9% | .xyz 75.4%, .cat 63.7%, .email 54.2% | .bond 1.82%, .beer 5.20%, .skin 5.59% |
| Country-code TLDs (ccTLDs): 167 TLDs, 97,233,639 domains | 52.1% | .hr 85.7%, .jp 79.8%, .za 78.6% | .gq 0.04%, .tk 0.18%, .cf 0.25% |
The largest TLD in this base, .com, stands at 47.4% (72,923,947 of 153,849,480).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 331,781,273 of the 332,492,319 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 7 Email Security checks with a published figure, SPF record has the 4th highest pass share. Next above it is DKIM (DomainKeys Identified Mail): 50.5% of domains where a DKIM selector could be determined. Next below it is SPF policy strength: 18.5% of graded domains. Across every check with a published figure it ranks 13th of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
SPF records over the lookup limit
In the census SPF evidence, 8,317 of the 157,065,571 domains that publish an SPF record need more than 10 DNS (Domain Name System) lookups to evaluate it, the limit RFC 7208 (Request for Comments) sets. That is 0.01% of SPF publishers. The same evidence cannot separate a record that fails to parse, or a domain with two SPF records, from the other states, so neither is counted here.
Further reading: SPF PermError: too many DNS lookups, and how to get back under ten
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix SPF
SPF setup walkthroughs for 8 providers: AWS Route 53, Beget, GoDaddy, Hostinger, Porkbun, REG.RU, Timeweb, Wix. All of them are on the SPF setup walkthroughs by provider page.
Cite this check
Defaults.Exposed, "SPF record (spf-exists)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/spf-exists
Permalink: https://defaults.exposed/methodology/spf-exists ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data