Defaults.Exposed › Stats › Email authentication (SPF, DKIM, DMARC)
What percent of SPF records end in -all (hard fail)?
October 2026 census edition
As of October 12, 2026, 39.1% of the 157,065,571 SPF (Sender Policy Framework) records in the Defaults.Exposed census end in -all (hard fail), 61,408,709 domains telling receivers to reject unauthorized senders outright.
SPF hard fail share: how it is measured
It comes from the SPF parsing pass, which retrieves every published SPF record, follows its mechanisms, and records both the terminal qualifier and the DNS-lookup cost of evaluating it. Every domain in the census is measured directly and counted once.
The terminal qualifier is where an SPF record states its intent. A record ending in -all asks receivers to reject anything from an unlisted server outright. It is the strict setting, and the one most likely to be softened after a legitimate sender is missed during rollout.
The denominator under that share is 157,065,571: the population where this particular check had something to read. A domain the census could not decide on is recorded as undetermined and left out of it, never counted as a failure.
It moves when domain owners publish, correct or remove the DNS (Domain Name System) records that authenticate their mail. Every one of those records is free and takes minutes to publish, and together they decide whether someone else can send mail as the domain. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see fix your email authentication.
the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
| SPF terminal qualifier | Records |
|---|---|
| -all (hard fail) | 61,408,709 |
| ~all (soft fail) | 87,173,390 |
| ?all (neutral) | 5,196,769 |
| +all (allows anyone) | 40,988 |
| No terminal all (redirect/include-only) | 3,245,715 |
SPF hard fail share: how to cite it
Please cite Defaults.Exposed and link this page. The citation below carries the date.
Defaults.Exposed, "What percent of SPF records end in -all (hard fail)?" (as of October 12, 2026). https://defaults.exposed/stats/what-percent-of-spf-records-use-hard-fail
Permalink: https://defaults.exposed/stats/what-percent-of-spf-records-use-hard-fail · Machine-readable: /stats/s/spf-hardfail.json · Licence: open data
Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.