Should SPF records provided by ISPs contain "all" at the end?
Solution 1:
The include
directive ignores terminal all
s of any kind, as the project's page on the record syntax makes (fairly) clear:
In hindsight, the name "include" was poorly chosen. Only the evaluated result of the referenced SPF record is used, rather than acting as if the referenced SPF record was literally included in the first. For example, evaluating a "-all" directive in the referenced record does not terminate the overall processing and does not necessarily result in an overall Fail. (Better names for this mechanism would have been "if-pass", "on-pass", etc.)
You will still need to terminate your SPF record, however many other organisations' records it include
s, with your own -all
(and may I urge you use -all
, not ~all
or ?all
, as the latter two make SPF completely pointless?).