Use wildcard reject SPF for nameserver entries, for example: example.net TXT "v=spf1 include:spf.yourmailprovider.example -all" *.example.net TXT "v=spf1 -

Use wildcard reject SPF for nameserver entries, for example: example.net TXT "v=spf1 include:spf.yourmailprovider.example -all" *.example.net TXT "v=spf1 -all" and use strict DMARC policies. Unfortunately due to how DNS was defined, wildcard entries are not used whenever a subdomain is defined - even if its an A entry, so if you use an active subdomain (www is used most of the time) you unfortunately need to add them manually*. Also depending on your specific provider you may not be able to add them (unfortunately that's on them). * Except on, rather surprisingly, Microsoft's DNS servers (you can tick a box to force an wildcard entry to show up even if there are records already defined).