Change ?all in the SPF record to ~all
Why it matters
?all says nothing about servers that are not listed, so receivers cannot treat spoofed mail as suspicious on SPF alone. ~all and -all state a real policy.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Check that every service sending mail as your domain appears in the record (mail provider, newsletter tool, contact forms, helpdesk).
- Change the final ?all to ~all. Mail from unlisted senders is then marked suspicious rather than treated as neutral.
- After DMARC reports show everything legitimate passing, tighten to -all if you want a hard fail.
dns
example.com. IN TXT "v=spf1 include:_spf.YOUR-MAIL-PROVIDER.example ~all" The examples use example.com. Replace it with your own domain.
Related
- Reported by the SPF record check
- Publish an SPF record
- Merge the SPF records into one
- Fix the syntax error in the SPF record
- Replace +all in the SPF record with ~all
- Narrow the very large address range in the SPF record
- Choose the right SPF ending for this domain
- End the SPF record with ~all or -all
- Bring the SPF record under 10 DNS lookups
- Leave room under the SPF lookup limit
- Remove SPF terms that point at names that no longer exist
- Fix the SPF include that has no SPF record
- Break the loop in the SPF includes
- Replace the include that has several SPF records
- Replace the ptr mechanism in the SPF record
- Check the SPF terms that use macros
- Re-run the scan if part of the SPF record could not be read
Scan your domain to see whether this applies to you.