DNS guides

SPFBreaks authentication

No SPF record found: how to add one

Your domain has no SPF record, so receivers can't tell which servers may send as you. Here's what to put in it and where it goes.

What it means

SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send email with your domain in the envelope sender. Receivers look it up on every message.

With no record, the SPF result is "none": the receiver has nothing to compare the sending server against, so it can't confirm the email is really yours.

Why it matters for cold email

Gmail and Yahoo require SPF or DKIM from every sender, and both from bulk senders. Cold email from a domain without SPF is far more likely to land in spam or be rejected, and a missing record is one of the first things spam filters notice on a new domain.

How to fix it

  1. List every service that sends email as your domain: your mailbox provider (Google Workspace, Microsoft 365…) and any tools that send for you.
  2. Build one record that starts with v=spf1, includes each service, and ends with ~all. Our SPF generator does this for you.
  3. Add it as a TXT record on the root of the domain (host @ or blank) at your DNS provider.
  4. Wait for DNS to update (minutes to a few hours), then run the checker again.

A domain that sends only through Google Workspace

Record

v=spf1 include:_spf.google.com ~all

Questions

Should I use ~all or -all?

Both tell receivers that other servers aren't allowed. ~all (soft fail) is the safer start while you confirm every sender is listed; -all (fail) is stricter. With DMARC in place the difference matters less, because DMARC decides what happens to failing mail.

Do I need a separate SPF record for each tool?

No. A domain must have exactly one SPF record. Add each tool as another include in the same record.

Related problems

Last checked 2026-10-21 against RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 7489 (DMARC). Full setup guide

Sending cold email? Outsquid re-checks these records for every sending domain every hour, so a broken one doesn't go unnoticed. How deliverability works