Guides › SPF
SPF ~all vs -all: softfail or hardfail?
| Ending | Result for unlisted senders | Use? |
|---|---|---|
-all | Fail | Good for domains with fully known senders, and for non-sending domains (v=spf1 -all). |
~all | Softfail | The usual choice when you also have DMARC. |
?all | Neutral | No protection. Avoid. |
+all | Pass | Never. It authorises everyone. |
Why ~all is often fine
With DMARC in place, the DMARC policy decides what happens to failing mail, not the SPF qualifier. Some receivers reject on -all during the SMTP transaction before checking DKIM, which can break legitimately forwarded mail. Many deliverability teams therefore pair ~all with p=reject. Either is acceptable. What matters most is having DMARC.
Check your domain now