SPF record with `+all`

The last mechanism of an SPF record says what happens to every server not listed. `-all` means reject, `~all` means suspicious, `+all` means allowed too. A record with `+all` therefore passes for every server on earth — it is worse than no SPF at all, because it actively tells receivers the forgery is fine.

It usually happens during setup: one service would not pass the check, someone added `+all` as a stopgap — and never removed it. A bare `all` without a qualifier means the same as `+all`.

Check it yourself: `dig TXT your-domain.com +short` — the `v=spf1` line must not end in `+all` or `all`. Each provider documents its `include:` entry.