webzod
account

Choose the right SPF ending for this domain

email.spf.softfail_all · effort: minutes

Why it matters

A domain that sends no mail should publish -all so spoofed mail claiming to come from it is rejected outright. A domain that does send mail can keep ~all while DMARC enforces; -all is the stricter option once every sender is listed.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. If this domain sends no mail (no MX, or a null MX, and no sending service), replace the whole record with v=spf1 -all. Also publish DMARC p=reject (see the DMARC fix) and, only if no mailbox uses this domain, a null MX (MX priority 0, target a single dot); this is safe because nothing legitimate is sent.
  2. If it does send mail, ~all is fine while a DMARC policy of quarantine or reject is in place. Change to -all only after DMARC reports show all legitimate senders pass SPF; note that -all can cause forwarded mail to be rejected before DMARC is considered.
dns 
; Domain that sends no mail
example.com.  IN TXT  "v=spf1 -all"
; Only if no mailbox uses this domain, also publish a null MX (RFC 7505)
; example.com.  IN MX  0 .

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.