Below is a gif image I’ve made of the header from a bounced email returned to my XXXXX.COM domain. The person it’s from, Huber R. Maria, does not exist. Apparently my domain is being “JoeJobbed”. I have had the SPF set to FAIL for ages.
If you have a catch-all, SPF is no gurantee(unless all mailservers use it) for this. It is just better to have one than none.
Thanks. I did have a catch all which is now turned off.