How to tighten a weak SPF record (-all instead of +all)
An SPF record ending in +all or ?all, or with no all at all, blocks nobody — it effectively lets any server send as you. End it with -all (reject), or ~all while testing.
Before switching to -all, make sure every system that sends email for you is in an include, or your real email will be rejected.
How to fix it
DNS registrar
Where: your DNS provider — edit the existing SPF TXT record on the root domain
Type: TXT Name: @ Value: "v=spf1 include:_spf.google.com -all"
Keep your own include: entries and end the record with -all (or ~all while testing) so receivers reject mail from servers you did not list. +all / ?all / no 'all' accept anyone.
How to confirm: Use mxtoolbox.com/spf to confirm the record ends in -all or ~all.
Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.
Scan your site free