Replace +all in the SPF record with ~all

Why it matters

+all (or a bare all) tells receivers that every server on the internet may send mail as your domain, which is worse than having no SPF record. It is usually a leftover from testing or a copied example.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Open the SPF record. If +all (or a plain all with no qualifier) is in your own record, change it to ~all. If the finding says an included record ends in +all, that third party has to fix it, or you should drop that include.
2. Before saving, check that every service that sends your mail is listed in the record. Mail from senders you did not list will now fail SPF; if DMARC is at quarantine or reject and that sender has no aligned DKIM, it will be quarantined or rejected, so list every sender first.
3. Once DMARC reports show every legitimate sender passing, you may tighten ~all to -all.

example.com.  IN TXT  "v=spf1 include:_spf.YOUR-MAIL-PROVIDER.example ~all"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the SPF record check
• Publish an SPF record
• Merge the SPF records into one
• Fix the syntax error in the SPF record
• Narrow the very large address range in the SPF record
• Change ?all in the SPF record to ~all
• Choose the right SPF ending for this domain
• End the SPF record with ~all or -all
• Bring the SPF record under 10 DNS lookups
• Leave room under the SPF lookup limit
• Remove SPF terms that point at names that no longer exist
• Fix the SPF include that has no SPF record
• Break the loop in the SPF includes
• Replace the include that has several SPF records
• Replace the ptr mechanism in the SPF record
• Check the SPF terms that use macros
• Re-run the scan if part of the SPF record could not be read