diff --git a/CHANGELOG.md b/CHANGELOG.md
index e0912721..577f7daa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -77,6 +77,7 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 - JMAP: `Thread/get` did not filter by per-mailbox ACLs on shared accounts.
 - RFC2136 TSIG: regression related to multiplexer.
 - IMAP: `UID FETCH N:*` could miss messages moved into a SELECTed mailbox by another connection.
+- DNS records: Skip `v=spf1 a -all` records for apex domains.
 
 ## [0.16.5] - 2026-05-11
 
diff --git a/crates/common/src/network/dns/records.rs b/crates/common/src/network/dns/records.rs
index 87942695..eadc5b51 100644
--- a/crates/common/src/network/dns/records.rs
+++ b/crates/common/src/network/dns/records.rs
@@ -78,7 +78,7 @@ impl Server {
                         .collect::<AHashSet<_>>();
 
                     for mx in mxs {
-                        if mx.ends_with(&domain_name_suffix) || mx == domain_name {
+                        if mx.ends_with(&domain_name_suffix) {
                             records.push(NamedDnsRecord {
                                 name: format!("{mx}."),
                                 record: DnsRecord::TXT("v=spf1 a -all".to_string()),