Email · appears in CAIQ, SIG, SOC 2
Is SPF published with a hardfail (-all) policy on the sending domain?
SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).
How to answer this
Whichever verdict your domain earns, this is the wording to put in the response box. Reviewers mark an answer down for vagueness more often than for a "No", so say which state you are in and what evidences it.
- Yes
- SPF is published with a hardfail (-all) policy
- Partial
- SPF is published but not at hardfail
- No
- SPF is not published or is misconfigured
Controls this evidences
| Framework | Control | Why it maps |
|---|---|---|
| SOC 2 | CC6.7 | SPF prevents unauthorised servers from sending mail as your domain. |
| ISO 27001 | A.8.20 | Information transfer policies — email sender authentication. |
| NIST 800-53 | SC-8 | — |
Domain Posture is not an audit and does not replace an auditor. See methodology v1 for how each verdict is reached.
When a "Yes" stops being true
SPF removed, relaxed to ~all/?all, or pushed past the 10-lookup limit.
That is the whole problem with answering a questionnaire from a screenshot: the answer was true the day you took it. A signed evidence pack is dated, and a schedule re-checks it so you find out before your reviewer does.