Also consider (using your example domain):
*.mydomain.io. TXT "v=spf1 -all"
to restrict SPF on all subdomains. *.mydomain.io. TXT "v=spf1 -all"
to restrict SPF on all subdomains.