The State of SPF - Korea

We read the SPF records of 5,798 .co.kr domains. 85.6% of them used ~all instead of -all. That is much higher than the worldwide average of 53.6%.

What is an SPF record?

An SPF record is a single TXT record in DNS. It's the value the email server receiving an email message uses to check if the sender server's IP address is authorized to send email for your domain.

Example SPF record authorizing Google to send email for you:

v=spf1 include:_spf.google.com ~all

include:_spf.google.com delegates authority to every IP address part of an answer of a query for _spf.google.com A or AAAA record.

The all in the final term, ~all, includes every other IP address.

Here are the most common domains we saw in Korea.

_spf.daum.net (465 records)
email.ncloud.com (463)
_spf.google.com (378)
spf.protection.outlook.com (296)
spf.cafe24.com (279)

SPF checks the address in the SMTP MAIL FROM command. That is not the same address as the recipient's mail client shows them. The From: line they read can carry a different domain entirely. That's why DMARC is important: it forces From: to match MAIL FROM.

RFC 9989 §3.2.4: "DMARC relies solely on SPF validation of the MAIL FROM identity."

We measured Korea's DMARC posture in the previous post.

Korea Experiment

We tested 10,135 Korean registrable domains from a Tranco snapshot, 10,123 of them .co.kr. 201 of them failed lookups, so we were left with 9,934. A domain "publishes SPF" when it answers a TXT query with a record beginning with v=spf1.

5,798 of the 9,934 publish an SPF record. 58.4%, about the same as the global 56.0%.

Of the 66.1% of domains that publish an MX record (which essentially means they might send email), 83.1% also publish SPF.

KISA, reported by inews24 out of 460,000 Korean domains running mail servers (June 2017), 66% (about 300,000) publish SPF.
Lazy Gatekeepers, a 2025 study of 12.8 million Tranco domains scanned in 2023, puts SPF at 56.5% across that whole list. Narrowing to the top million, which is where the paper focuses, it reports that "the usage of SPF per domain has grown to 60.2 % of all scanned domains and 79.3 % for domains with MX record."

66% in Korea nine years ago, 79.3% among the world's top-million mail-serving domains three years ago, 83.1% here now — and 8,248 of our 9,934 domains rank past one million, so this sample clears that bar from well below it. Korea's problem is not adoption.

It tracks company size here as it does everywhere: 82.8% of the 128 domains inside the global top 100,000 publish SPF, 70.7% of the 1,558 between 100,000 and one million, and 55.6% of the 8,248 past rank one million. The top band is only 128 domains, so read it as a hint.

And almost none of it asks anyone to act

Now the last term. Of the 5,798 records:

4,964 (85.6%) use ~all (softfail)
772 (13.3%) use -all (fail)
35 domains have no all
25 domains use redirect=
2 domains use ?all
No domain uses +all

RFC 7208 is explicit about what each of the two asks for.

RFC 7208 §8.5: "A 'softfail' result ought to be treated as somewhere between 'fail' and 'neutral'/'none'. The ADMD believes the host is not authorized but is not willing to make a strong policy statement. Receiving software SHOULD NOT reject the message based solely on this result, but MAY subject the message to closer scrutiny than normal."

RFC 7208 §8.4: "A 'fail' result is an explicit statement that the client is not authorized to use the domain in the given identity. Disposition of SPF fail messages is a matter of local policy."

A ~all record still does something. A receiver may score it, greylist it, or drop it in a spam folder. What the domain owner withholds is the strong statement. -all makes that statement, and it works on its own — the receiver's local policy can act on a fail with no DMARC record anywhere in the picture.

A ~all majority is normal. DMARCguard's 2026 scan found 53.6% of the world's SPF publishers ending ~all and 40.2% ending -all.

What's weird is how Korea's -all is so low compared to the rest of the world.

In fact, 13.3% -all is less than the world average in 2017, which was around 27.4%: Hu and Wang.

Another weird thing is that 3,901 of the 4,964 ~all domains have no usable DMARC policy.

Our hypothesis

We believe domain owners just copy and paste SPF configuration from major mail providers.

For instance, Google's Workspace admin guide says:

Google Workspace Admin Help, "Set up SPF": "The ~all tag tells receiving servers to mark messages as spam if they're from servers that aren't listed in the SPF record. Google recommends you use ~all in your SPF record."

And Cafe24's webmail guide tells admins to use:

v=spf1 ip4:183.110.224.0/24 ip4:175.126.146.0/24 ip4:112.175.12.0/24 ip4:118.219.233.0/24 ~all

The Cafe24 guide largely explains two of our findings. First, it ends with ~all. Second, it names its senders as bare CIDR blocks. It turns out 2,463 Korean domains (42.5%) do the exact same.

Stibee: v=spf1 include:mail.stibee.com ~all.

Microsoft is an outlier:

Microsoft Learn, "Set up SPF to identify valid email sources for your Microsoft 365 domain": "For Microsoft 365 domains, we recommend -all (hard fail) because we also recommend DKIM and DMARC for the domain."

Of the four quoted services, the three that recommend ~all account for 795 records in our experiment. 378 for Google, 279 for Cafe24, 138 for Stibee. Microsoft, which recommends -all, has 296 pointing to it.

How to check your domain

Run this to read your domain's SPF record:

dig +short yourcompany.co.kr TXT

The SPF record begins with v=spf1.

We would love to know: when you set up mail for your domain, did you use the hosting provider example and just stuck with it?

References

IETF — RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1 (April 2014)
IETF — RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC) (May 2026)
inews24 — KISA, 포털 등에 이메일 발신서버 진위 확인기술(SPF) 적용 권고 (KISA recommends portals apply sender-server verification technology; 6 July 2017)
Stefan Czybik, Micha Horlboge, Konrad Rieck — Lazy Gatekeepers: A Large-Scale Study on SPF Configuration in the Wild (arXiv:2502.08240, 2025; 12,823,598 domains scanned January–May 2023)
Hang Hu, Gang Wang — Revisiting Email Spoofing Attacks (arXiv:1801.00853, 2018; data collected October 2017)
DMARCguard — SPF Supply Chain 2026 (vendor research; 5,499,028 Tranco domains scanned 15 March 2026)
Google Workspace Admin Help — Set up SPF
Cafe24 — 웹메일 스팸 설정 및 관리 가이드 (webmail spam settings and management guide)
스티비 (Stibee) Help — SPF, DKIM 설정 이해하기 (understanding SPF and DKIM setup)
Microsoft Learn — Set up SPF to identify valid email sources for your Microsoft 365 domain