spf

What is checked: one TXT record starting v=spf1 on your mail domain, ending in -all or ~all, needing at most 10 DNS lookups (RFC 7208).

Why it matters: SPF lists the servers allowed to send mail as your domain. Without it, or with ?all / +all, anyone can send mail that appears to come from you.

Smallest fix: ask your mail provider for their SPF include and publish, for example:

example-gemeinde.ch.  TXT  "v=spf1 include:spf.protection.outlook.com -all"

List every service that sends as your domain (newsletter, online desk, scanners). Keep one record only: two SPF records make both invalid. If you hit the 10-lookup limit, remove includes you no longer use or ask the provider for a flattened include.

A domain that never sends mail should publish v=spf1 -all.