The Problem With Using +all in SPF Records

November 29, 2025 • InboxGreenEmail Team

🚨 DKIM issues can silently kill replies.

If opens dropped, replies disappeared, or bounces increased, treat it as an incident. Run the scan and get a fix path.

No signup required. Works on any domain.

search Run a Free Domain Check notifications_active Monitor my domain

The Problem With Using +all in SPF Records

When it comes to email deliverability, the details matter. One of the most common mistakes I see is the use of +all in SPF records. It may seem harmless, but it can cause significant issues for your email campaigns. Let’s dive into why this is a problem and how you can fix it.

What is SPF and Why Does It Matter?

Sender Policy Framework (SPF) is a DNS record that helps to prevent email spoofing. It tells receiving mail servers which IP addresses are allowed to send emails on behalf of your domain. If you don't configure SPF correctly, your emails may end up in spam folders or not be delivered at all.

Understanding +all

The +all mechanism in an SPF record indicates that any server can send emails for your domain. This might seem convenient, but it opens the floodgates for spammers. When you use +all, you essentially say, "I trust everyone." This is a big mistake.

Real-World Consequences

Let’s say you have a SaaS product and you send out marketing emails. If your SPF record includes +all, any spammer can send emails that appear to come from your domain. This can lead to:

  • Increased spam complaints
  • Damage to your domain's reputation
  • Lower inbox placement rates

Ultimately, this can hurt your business. You lose potential customers and your brand suffers. So, what can you do instead?

Diagnosing Your SPF Record

First, check your current SPF record. You can use the InboxGreen checker to see what your SPF looks like. Look for the +all mechanism. If it’s there, it’s time for a change.

How to Fix Your SPF Record

Here’s a step-by-step guide to properly configure your SPF record:

  1. Identify your sending sources: List all the IP addresses and third party services that send emails on behalf of your domain. This could include your own mail servers, marketing platforms like Mailchimp, or CRM systems.
  2. Update your SPF record: Remove +all and replace it with specific IP addresses or include mechanisms for trusted services. A typical SPF record might look like this:
v=spf1 ip4:192.0.2.1 include:mailchimp.com -all

This record allows emails from your server at 192.0.2.1 and Mailchimp, while rejecting all others.

  1. Test your SPF record: After updating, use the InboxGreen checker again to ensure your SPF record is valid and does not include +all.
  2. Monitor your email performance: Keep an eye on your inbox placement rates. If you notice issues, revisit your SPF record.

Additional Considerations

While fixing SPF is essential, don’t forget about DKIM and DMARC. These are equally important for email authentication. DKIM adds a digital signature to your emails, while DMARC helps manage how receiving servers handle emails that fail SPF or DKIM checks.

To create a DMARC record, you can use the DMARC generator from InboxGreen. A basic DMARC record might look like this:

v=DMARC1; p=none; rua=mailto:[email protected]

This record tells receiving servers to send reports to you without rejecting emails that fail authentication checks. Start with p=none to monitor your results before enforcing stricter policies.

What to Do Next

Now that you understand the risks of using +all in your SPF records, it's time to take action. Start by checking your SPF record with the InboxGreen checker. If you find +all, follow the steps outlined above to fix it. Consider using the SPF generator to help create a more secure record.

Remember, email deliverability is not just about sending emails. It's about ensuring they reach your audience’s inbox. Take control of your email reputation today.

For more tools and resources, check out our pricing page to see how InboxGreen can help you improve your email deliverability.

Free Deliverability Scan

Check SPF, DKIM, DMARC and List-Unsubscribe for your domain in seconds.