End the SPF record with ~all or -all
Why it matters
Without a final all (or a redirect) servers that are not listed get a neutral result, so receivers have no policy to apply to spoofed mail. Adding an ending makes the list actually mean something.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Check every service that sends mail as your domain is in the record.
- Add ~all as the very last term of the record. Terms after all are ignored, so it must be last.
- Tighten to -all later if you wish, once DMARC reports show nothing legitimate failing.
dns
example.com. IN TXT "v=spf1 include:_spf.YOUR-MAIL-PROVIDER.example ~all" The examples use example.com. Replace it with your own domain.
Related
- Reported by the SPF record check
- Publish an SPF record
- Merge the SPF records into one
- Fix the syntax error in the SPF record
- Replace +all in the SPF record with ~all
- Narrow the very large address range in the SPF record
- Change ?all in the SPF record to ~all
- Choose the right SPF ending for this domain
- Bring the SPF record under 10 DNS lookups
- Leave room under the SPF lookup limit
- Remove SPF terms that point at names that no longer exist
- Fix the SPF include that has no SPF record
- Break the loop in the SPF includes
- Replace the include that has several SPF records
- Replace the ptr mechanism in the SPF record
- Check the SPF terms that use macros
- Re-run the scan if part of the SPF record could not be read
Scan your domain to see whether this applies to you.