Defaults.Exposed › October 2026 census › v10 registry › SPF policy strength
SPF policy strength
Methodology v10 · canonical ID spf-policy-strength · Email Security · scored
A weak SPF (Sender Policy Framework) only warns; a strict one actually blocks forgeries.
SPF policy strength: definition
| Canonical ID | spf-policy-strength |
|---|---|
| Category | Email Security |
| Grade impact | Scored, counts toward the grade |
| Pass | The SPF record ends in a hardfail all-mechanism (-all), telling receivers to reject unauthorized senders. |
| Fail | The record ends in ~all (softfail), ?all (neutral), or +all (permits anyone), or no SPF exists. |
| Example (passing) | v=spf1 include:_spf.example-mailer.com -all |
SPF policy strength across the census
18.5% of graded domains publish SPF with a hardfail (-all) policy (61,408,709 of 332,492,319, as of October 12, 2026).
Softfail (~all) records count toward SPF presence but not full policy strength.
Aggregates only: never an individual domain's result.
How this check is scored
SPF policy strength is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, every graded domain had a determinable result for this check.
Every outcome in the census
The table covers the 157,065,571 domains that publish an SPF record. The other 175,426,748 of the 332,492,319 graded domains publish none.
| Outcome | Domains | Share of domains that publish an SPF record | In the headline figure |
|---|---|---|---|
| Ends in -all (hardfail): passes this check | 61,408,709 | 39.1% | Yes |
| Ends in ~all (softfail) | 87,173,390 | 55.5% | No |
| Ends in ?all (neutral) | 5,196,769 | 3.31% | No |
| Ends in +all (permits any sender) | 40,988 | 0.03% | No |
| No terminal all mechanism | 3,245,715 | 2.07% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
By top-level domain
This splits the share of graded domains that publish SPF with a hardfail (-all) policy by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 353 TLDs, 234,547,634 domains | 18.1% | .xyz 69.7%, .help 37.9%, .group 26.0% | .bond 0.44%, .garden 1.01%, .skin 1.43% |
| Country-code TLDs (ccTLDs): 167 TLDs, 97,233,639 domains | 19.3% | .pl 43.3%, .gr 36.7%, .ch 36.0% | .gq 0.02%, .tk 0.07%, .cf 0.20% |
The largest TLD in this base, .com, stands at 18.7% (28,795,713 of 153,849,480).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 331,781,273 of the 332,492,319 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 7 Email Security checks with a published figure, SPF policy strength has the 5th highest pass share. Next above it is SPF record: 46.3% of graded domains. Next below it is DMARC (Domain-based Message Authentication, Reporting and Conformance) policy: 12.0% of graded domains. Across every check with a published figure it ranks 17th of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix SPF
SPF setup walkthroughs for 8 providers: AWS Route 53, Beget, GoDaddy, Hostinger, Porkbun, REG.RU, Timeweb, Wix. All of them are on the SPF setup walkthroughs by provider page.
Cite this check
Defaults.Exposed, "SPF policy strength (spf-policy-strength)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/spf-policy-strength
Permalink: https://defaults.exposed/methodology/spf-policy-strength ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data