email-auth · severity high

SPF policy

Share of email-active domains with no enforcing SPF record (absent, ~all soft-fail, or +all).

Measured every Monday · last updated

How it is measured

Tier 0. TXT at the apex; find v=spf1, read the all qualifier, count direct lookups. Denominator: has_mx.

Why it matters

~all is the SPF equivalent of p=none and overwhelmingly the most common configuration — it asks receivers to accept-but-mark, so spoofed mail still arrives. +all authorises the entire internet to send as you. Exceeding the 10-lookup limit makes the record fail permanently and silently, because receivers abort evaluation.

Limits of this measurement

The lookup count is non-recursive (it does not expand include:), so it is a lower bound and catches only egregiously over-limit records.

The base rate

Two independent populations. The global, domain-anchored figure is unbiased; the company-anchored figures are built by matching company names to domains and skew toward more digitally-mature firms. Both are published, so the gap is visible.

Global (all domains) 72.34% fail · n=15,007
-all (enforced): 27.66%~all (soft-fail): 50.75%?all / none: 6.33%+all: 0.06%>10 lookups: 0.01%no record: 15.19%
France companies 58.15% fail · n=841
-all (enforced): 41.85%~all (soft-fail): 39.6%?all / none: 4.76%>10 lookups: 0.12%no record: 13.67%
UK companies 57.22% fail · n=2,597
-all (enforced): 42.78%~all (soft-fail): 35.89%?all / none: 2.89%>10 lookups: 0.08%no record: 18.37%
Norway companies 44.49% fail · n=944
-all (enforced): 55.51%~all (soft-fail): 29.45%?all / none: 1.38%no record: 13.67%
-all (enforced) · 55.51%~all (soft-fail) · 29.45%?all / none · 1.38%no record · 13.67%

By company size band

Company-anchored cuts (national registries with a size proxy), split by size band. Right-hand figure is the share not meeting the control.

France
micron=212
-all (enforced): 30.66%~all (soft-fail): 48.58%?all / none: 7.08%no record: 13.68%
69.34%
smalln=245
-all (enforced): 40.82%~all (soft-fail): 44.9%?all / none: 4.08%no record: 10.2%
59.18%
mediumn=200
-all (enforced): 49.5%~all (soft-fail): 33.5%?all / none: 3.5%no record: 13.5%
50.5%
largen=184
-all (enforced): 47.83%~all (soft-fail): 28.8%?all / none: 4.35%>10 lookups: 0.54%no record: 18.48%
52.17%
UK
micron=231
-all (enforced): 32.47%~all (soft-fail): 45.45%?all / none: 3.03%no record: 19.05%
67.53%
smalln=954
-all (enforced): 42.98%~all (soft-fail): 35.64%?all / none: 3.67%>10 lookups: 0.1%no record: 17.61%
57.02%
medium/largen=1025
-all (enforced): 48.78%~all (soft-fail): 30.05%?all / none: 2.34%>10 lookups: 0.1%no record: 18.73%
51.22%
dormantn=195
-all (enforced): 29.74%~all (soft-fail): 44.1%?all / none: 2.56%no record: 23.59%
70.26%
no-accountsn=192
-all (enforced): 35.42%~all (soft-fail): 48.44%?all / none: 2.08%no record: 14.06%
64.58%
Norway
micron=266
-all (enforced): 45.49%~all (soft-fail): 36.47%?all / none: 1.13%no record: 16.92%
54.51%
smalln=242
-all (enforced): 56.61%~all (soft-fail): 27.69%?all / none: 1.24%no record: 14.46%
43.39%
mediumn=253
-all (enforced): 58.89%~all (soft-fail): 28.85%?all / none: 1.58%no record: 10.67%
41.11%
largen=183
-all (enforced): 63.93%~all (soft-fail): 22.4%?all / none: 1.64%no record: 12.02%
36.07%

Every segment

Pick one to see the citable answer for a company like yours, with its trend and methodology.

Show the remaining 62 segments

From the newsletter

Where this base rate turned up as a real, fixable exposure.

Slices below 100 measured members are withheld rather than shown with a wide interval — an absent country or issuer means too little data, not zero failures. Licensed CC BY 4.0. Machine-readable data per segment: append .json or .csv to its URL.