Comment by teddyh

Also consider (using your example domain):

  *.mydomain.io. TXT "v=spf1 -all"

to restrict SPF on all subdomains.