DNS guides

SPFWorks, should be fixed

SPF record without ~all or -all

Your SPF record doesn't say what to do with servers it doesn't list, so they get a neutral result. End it with ~all or -all.

What it means

Without a final all mechanism (or with ?all), mail from servers not in the record gets SPF "neutral": the record neither allows nor denies them.

Neutral is treated much like no SPF at all. Receivers can't use it to reject someone pretending to be you.

Why it matters for cold email

Your own mail may still pass, but spoofed mail isn't caught, and filters read an open-ended record as weaker protection. It's a one-word fix.

How to fix it

  1. Add ~all to the end of the record (or change ?all to ~all).
  2. Move to -all later if you want receivers to reject unlisted servers outright.

Closing an open-ended record

Before

v=spf1 include:spf.protection.outlook.com

After

v=spf1 include:spf.protection.outlook.com ~all

Questions

Is ?all ever the right choice?

Only briefly while testing. It gives no protection, so finish with ~all or -all.

Related problems

Last checked 2026-10-21 against RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 7489 (DMARC). Full setup guide

Sending cold email? Outsquid re-checks these records for every sending domain every hour, so a broken one doesn't go unnoticed. How deliverability works