All fixes

Fix an SPF record that ends in +all

spf-too-permissive

An SPF record ending in +all authorises the whole internet to send as you, which is the same as having no SPF at all. End the record with -all.

Why this matters

Your SPF record uses +all, authorizing any server to send as you. This enables email spoofing for phishing, but is not direct system exploitation.

Cloudflare

  1. 1 Go to DNS > Records
  2. 2 Edit your SPF TXT record to replace +all with ~all or -all
  3. 3 +all allows anyone to send as your domain
Type: TXT
Name: @
Content: v=spf1 include:_spf.google.com -all

# -all = hard fail (recommended)
# ~all = soft fail (acceptable)
# +all = DANGEROUS — allows anyone
Cloudflare docs

Does your app still have this?

Scan your domain