Set your SPF enforcement correctly

Replace +all or a missing all mechanism with -all.

5 min

why this matters

The all mechanism is what tells receivers to act on a failure. Without it they treat failures as neutral, and +all actively invites anyone to spoof you.

Step by step

1
Confirm your sender list is complete
Enforcement only bites if a legitimate sender is missing from the record, so audit your sending services before tightening it.
2
Start with a soft fail
Change the end of the record to ~all and watch your DMARC reports for a week for senders you forgot.
```
v=spf1 include:_spf.google.com ~all
```
3
Move to a hard fail
Once reports are clean, switch to -all so unauthorised mail is rejected outright.
```
v=spf1 include:_spf.google.com -all
```