Every SPF record ends with a rule that says what to do with senders not listed above it. That ending is one of four small pieces of text, -all, ~all, ?all or +all, and the choice between them is the subject of countless forum posts and a lot of confusion. Some guides insist that you must use -all ("hard fail") for security. Others say that ~all ("soft fail") is the only safe choice. Both are partly right, and both leave out the part that matters most: what receiving servers actually do with the result, and how DMARC changes the picture. This guide explains the four qualifiers, shows what a receiving server does with each, explains why a softfail is often treated as a fail in practice, and gives a safe, step-by-step way to choose and to move from one to another. It also lists the mistakes that lead to legitimate mail being rejected.
How an SPF record is evaluated
When a message arrives, the receiving server looks at the domain in the envelope sender (the Return-Path) and fetches its SPF record from DNS. It reads the mechanisms from left to right, comparing the connecting IP address with each: ip4:, ip6:, a, mx, include: and so on. The first mechanism that matches decides the result, using its qualifier: + pass (the default if no qualifier is written), - fail, ~ softfail and ? neutral. If nothing matches, the last mechanism, all, matches every address and its qualifier decides. So the ending is the verdict for every sender you did not list. A complete walk-through of the syntax is in the SPF record guide.
The four endings
| Ending | Result name | Meaning | Typical receiver behaviour |
|---|---|---|---|
-all | Fail (hardfail) | "Only the listed servers may send. Reject others." | May reject during the SMTP conversation, or may use it as a strong spam signal; many receivers rely on DMARC and other signals instead |
~all | Softfail | "Others are probably not authorised, but treat with suspicion, not rejection." | Usually accepted but scored as suspicious; with DMARC, counts as a failed SPF check |
?all | Neutral | "No opinion about other servers." | Treated like no record for those senders |
+all | Pass | "Everybody may send as this domain." | Makes SPF worthless and invites spoofing; never use it |
The behaviour column is deliberately cautious. The SPF standard (RFC 7208) says what the results mean, but leaves the action to the receiver. Some receivers reject on a hard fail, many do not, and several treat a softfail and a fail in nearly the same way for filtering. You cannot rely on SPF alone to block spoofed mail, and you should not expect it to be the only reason a message is accepted.
Why DMARC changes the comparison
If your domain publishes DMARC, SPF becomes one of two inputs to a decision. DMARC needs SPF or DKIM to pass and align with the From domain. For SPF, a softfail is not a pass, so it counts as a failed check, exactly as a fail does. That means that with DMARC in place, the difference between ~all and -all has little effect on the DMARC result. What matters is whether your real senders pass and align. This is why many experienced administrators say that DMARC at p=reject with correct alignment protects the domain better than any choice of SPF ending. If you have not set up DMARC, read DMARC policy explained and alignment.
The risks of each choice
The risk of -all
If your record is incomplete, -all turns every gap into a failure. A marketing platform, a billing system, a help desk or a monthly report script that you forgot to include will fail SPF, and a receiver that rejects on SPF will refuse the message. Forwarding also causes failures: a forwarded message arrives from the forwarder's IP address, which is not in your record, so SPF fails even though the message is genuine. With -all, a strict receiver may reject forwarded mail that a softer one would deliver. DKIM, which survives forwarding when the message is not changed, is the remedy; see email forwarding explained.
The risk of ~all
The risk is complacency. The softfail stays in place for years because nobody revisits it, and attackers who spoof your domain face fewer obstacles at receivers that treat softfail leniently. If you do not have DMARC enforcement either, your domain is easy to spoof. Softfail is a reasonable stage but a poor destination for a domain that sends important mail.
The risk of ?all and +all
Neutral gives receivers no information. Pass-all is actively harmful: it tells the world that anyone may send as you. Search your records for +all, which sometimes appears after a copy-and-paste error or a misguided "fix" to make a failing sender pass.
A safe path from ~all to -all
- Inventory your senders. List every system that sends mail with your domain in the envelope sender: mailbox provider, website, CRM, marketing and transactional services, ticketing, billing and scripts. Ask each team.
- Publish DMARC with p=none and a reporting address. The aggregate reports show every source that sends as your domain and how SPF and DKIM performed. Follow the DMARC reports guide.
- Add legitimate senders. Use
include:mechanisms from each vendor, but watch the ten-lookup limit; see SPF too many DNS lookups and several senders and the lookup limit. - Align with DKIM wherever possible. Every sender should sign with your domain so that DMARC passes without relying on SPF.
- Run on ~all for a period. Watch the reports for several weeks, including month-end and quarterly sends. Fix every unknown legitimate source.
- Switch to -all. Once the reports show no legitimate source failing SPF, change the ending. Keep monitoring for a few weeks.
- Move DMARC toward enforcement. Quarantine and then reject, in steps.
If the domain never sends mail, such as a parked domain or a retired brand, use a record with -all straight away: v=spf1 -all. See parked and non-sending domains.
How to see what receivers did
Look at the Authentication-Results header of a delivered message and at Received-SPF if present. They show spf=pass, spf=softfail, spf=fail or spf=neutral, together with the domain and the IP that were checked. Our guide to reading email headers explains where to find them, and the SPF, DKIM and DMARC checker shows the current record. You can also query it yourself with dig TXT example.com +short. If SPF reports softfail for a message you sent, the connecting IP was not in the record.
Common mistakes
| Mistake | Effect | Fix |
|---|---|---|
| Two SPF records on one domain | Permanent error; SPF fails for everything | Merge them into a single record |
-all before all vendors are added | Legitimate mail fails SPF | Inventory senders and use reports first |
Ending the record without all | Receivers treat unlisted senders as neutral | End with ~all or -all |
Using +all to fix a failure | Anyone can send as the domain | Add the actual sender instead |
| More than ten DNS lookups | Permanent error at some receivers | Flatten or remove unused includes |
| SPF on the header domain only | Envelope domain is checked, not the header domain | Authenticate the envelope sender domain too (custom return path) |
| Forgetting subdomains | Subdomains have no record and are easy to spoof | Publish v=spf1 -all on subdomains that never send |
What to choose
If you are setting up a new domain that sends only through services you control, and you publish DMARC, start with ~all, move to -all after the reports are clean, and enforce DMARC. If the domain sends no mail, use -all from the start. If you use many senders and cannot yet inventory them, keep ~all and focus on DKIM and DMARC reporting first. In every case, remember that the ending matters less than the content of the record and the alignment of your senders. A perfect -all in front of a record that omits your billing system is worse than a careful ~all.
Authenticate every sender See the SPF, DKIM and return-path records you need for your domain, with a check that confirms they work.
References and further reading
Frequently asked questions
What is the difference between SPF softfail and fail?
Fail (-all) says unlisted senders are not authorised and may be rejected. Softfail (~all) says they are probably not authorised but should be treated with suspicion, not necessarily rejected.
Should I use ~all or -all?
Use ~all while you inventory senders and watch DMARC reports, then -all when no legitimate sender fails. Use -all at once on domains that send no mail.
Does softfail pass DMARC?
No. For DMARC, SPF must pass and align. A softfail counts as a failed SPF check, so DMARC depends on aligned DKIM.
Why does forwarded mail fail SPF?
The forwarder sends from its own IP address, which is not in your record. Aligned DKIM that survives forwarding lets DMARC pass.
Is +all ever acceptable?
No. It authorises every server to send as your domain and makes SPF useless.