I’ve configured SPF on my domain to allow incoming email from 3 domains only. The SPF record is ending with -all. With this said I receive spam email messages with my spoofed email address. For instance yesterday from host
200-4-83-129.hacienda.gob.mx but also from other hosts not in the SPF configutstion with my email address as sender address.