DNS guides

SPFBreaks authentication

SPF +all: your record lets anyone send as you

An SPF record ending in +all (or a bare all) authorises every server on the internet. Change it to ~all or -all.

What it means

The all mechanism matches any server not listed earlier in the record. Its qualifier says what to do with them: + pass, ~ soft fail, - fail, ? neutral. A bare all means +all.

So +all says every server in the world may send as your domain. It defeats the point of having SPF.

Why it matters for cold email

Spam filters know +all is a sign of a careless or abused domain, and anyone can use it to make spoofed mail pass SPF as you. That spoofed mail hurts the reputation your cold email depends on.

How to fix it

  1. Check that every service that really sends as you is listed in the record.
  2. Change the final +all (or all) to ~all.
  3. Once reports confirm nothing legitimate fails, you can tighten it to -all.

The same record, closed

Before

v=spf1 include:_spf.google.com +all

After

v=spf1 include:_spf.google.com ~all

Questions

Why would a record end in +all?

Usually a copy-paste from an old guide, or someone "fixing" delivery for a tool they forgot to include. Add that tool's include instead.

Related problems

Last checked 2026-10-21 against RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 7489 (DMARC). Full setup guide

Sending cold email? Outsquid re-checks these records for every sending domain every hour, so a broken one doesn't go unnoticed. How deliverability works