David Woodhouse wrote:
Unless you can truthfully state that mail from your domain will never be
sent to a third-party address which is forwarded without SRS, then
'-all' doesn't accurately reflect your situation either.
If you sign all envelope senders and you have set up a custom DNS server to
check the signatures by using the 'exists' mechanism, then you can have
'-all' in your SPF record.
Roger