SPF allows the entire internet (+all)

Check id: spf.all_plus · fix effort: low

What it means

Your SPF record ends in +all, which tells the world that anyone may send email as your domain. That's worse than having no record at all.

The technical detail

+all makes every source pass SPF. Spoofed mail gets a passing authentication result.

How to fix it

  1. Replace +all with ~all, then -all once you've confirmed all legitimate senders are listed.
  2. Rescan to verify.

Does your domain have this problem?

Run a free scan, takes about ten seconds.