SPF record ends with a permissive all mechanism
ShipReady found an SPF record whose terminal all mechanism permits every sender.
Why it matters
A permissive terminal mechanism can make the published sender-authorisation record less useful for distinguishing intended senders from other sources.
How ShipReady detects it
What it inspects
ShipReady reads the selected SPF record text and evaluates its supported terminal all mechanism.
What triggers a finding
The rule triggers when the SPF record ends with a bare all or explicit +all mechanism.
What the evidence shows
The observed SPF record contains the scanner's supported permissive terminal all form.
Limits of this check
ShipReady does not simulate receiving-server SPF evaluation, send mail, inspect DKIM or DMARC alignment, or guarantee any provider's treatment of a message.
How to fix it
Confirm legitimate sending sources
Inventory authorised senders before changing SPF so legitimate mail is not interrupted.
Choose an intended terminal policy
Use a tested terminal mechanism appropriate to the rollout, commonly softfail or hardfail after validation.
How to verify the change
Test legitimate sender paths
Query the deployed SPF record and separately test representative authorised mail flows.
Expected: The record authorises intended senders without using a permissive terminal all.