Narrow the very large address range in the SPF record

Why it matters

The record authorises a huge block of IP addresses to send as your domain, most of which are not yours. Anyone who controls one address in that block can send mail that passes SPF.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Find the ip4 or ip6 term named in the finding. A short prefix (/12 or shorter in IPv4, /24 or shorter in IPv6) covers an enormous number of addresses.
2. Replace it with the exact addresses or the smallest ranges your own mail servers send from. Your mail host or hosting provider can tell you which addresses those are.
3. Keep any existing include terms. Make the change while the old and new addresses are both listed if you are unsure, then remove the broad range after a few days of clean DMARC reports.

; Replace the broad range with the exact sending addresses (documentation addresses shown)
example.com.  IN TXT  "v=spf1 ip4:203.0.113.25 ip4:198.51.100.0/28 ~all"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the SPF record check
• Publish an SPF record
• Merge the SPF records into one
• Fix the syntax error in the SPF record
• Replace +all in the SPF record with ~all
• Change ?all in the SPF record to ~all
• Choose the right SPF ending for this domain
• End the SPF record with ~all or -all
• Bring the SPF record under 10 DNS lookups
• Leave room under the SPF lookup limit
• Remove SPF terms that point at names that no longer exist
• Fix the SPF include that has no SPF record
• Break the loop in the SPF includes
• Replace the include that has several SPF records
• Replace the ptr mechanism in the SPF record
• Check the SPF terms that use macros
• Re-run the scan if part of the SPF record could not be read