Replace +all in the SPF record with ~all on Cloudflare

Why it matters

+all (or a bare all) tells receivers that every server on the internet may send mail as your domain, which is worse than having no SPF record. It is usually a leftover from testing or a copied example.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. In the Cloudflare dashboard open DNS > Records, edit the TXT record whose Content starts with v=spf1, and change +all (or the bare all) at the end to ~all.
2. Save. Leave TTL on Auto.

Type:     TXT
Name:     example.com
Content:  v=spf1 include:_spf.YOUR-MAIL-PROVIDER.example ~all

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the SPF record check
• Publish an SPF record
• Merge the SPF records into one
• Fix the syntax error in the SPF record
• Narrow the very large address range in the SPF record
• Change ?all in the SPF record to ~all
• Choose the right SPF ending for this domain
• End the SPF record with ~all or -all
• Bring the SPF record under 10 DNS lookups
• Leave room under the SPF lookup limit
• Remove SPF terms that point at names that no longer exist
• Fix the SPF include that has no SPF record
• Break the loop in the SPF includes
• Replace the include that has several SPF records
• Replace the ptr mechanism in the SPF record
• Check the SPF terms that use macros
• Re-run the scan if part of the SPF record could not be read