diff --git a/README.md b/README.md
index bf0e5641..d2f53796 100644
--- a/README.md
+++ b/README.md
@@ -161,7 +161,7 @@ Similar to DKIM, setting up SPF is highly recommended.
 Add a TXT record for `mydomain.com.` with the value:
 
 ```
-v=spf1 mx -all
+v=spf1 mx ~all
 ```
 
 What it means is only your server can send email with `@mydomain.com` domain.
diff --git a/app/dashboard/views/domain_detail.py b/app/dashboard/views/domain_detail.py
index 8773a970..3d40e686 100644
--- a/app/dashboard/views/domain_detail.py
+++ b/app/dashboard/views/domain_detail.py
@@ -42,7 +42,7 @@ def domain_detail_dns(custom_domain_id):
         custom_domain.ownership_txt_token = random_string(30)
         db.session.commit()
 
-    spf_record = f"v=spf1 include:{EMAIL_DOMAIN} -all"
+    spf_record = f"v=spf1 include:{EMAIL_DOMAIN} ~all"
 
     # hardcode the DKIM selector here
     dkim_cname = f"dkim._domainkey.{EMAIL_DOMAIN}"