SPF ~all vs -all: softfail vs hardfail explained

The very end of your SPF record — the all mechanism and its qualifier — tells receivers how to treat mail from servers not on your list. -all, ~all, ?all and +all mean very different things. Here's what each does.

What the "all" mechanism does

SPF lists the servers allowed to send for your domain, then ends with all to cover everything else. The qualifier in front of all sets the verdict for those "everything else" servers.

The four qualifiers

-all — hardfail. Unlisted servers fail SPF. The strict, recommended end state.
~all — softfail. Probably unauthorized; accept but mark. A safe default while you finish your sender list.
?all — neutral. No opinion. Barely better than having no SPF policy at all.
+all — pass everything. Anyone can send as you. Never use this.

What receivers actually do

With -all, a receiver can treat unlisted mail as a clear SPF failure. With ~all, most accept it but apply a small negative signal. On its own, neither blocks a forgery reliably — which is the key point below.

Why DMARC changes the stakes

SPF only produces a result; it doesn't decide the message's fate. DMARC is what turns a failure into a block. So the bigger question isn't ~all vs -all — it's whether DMARC is at enforcement. That said, a clean -all removes ambiguity and is the right target once your record is complete.

What to do

Use ~all while you confirm every legitimate sender is in the record.
Watch your lookup count as you add them.
Move to -all once you're confident nothing legitimate is missing.
Enforce DMARC — that's what actually stops the spoof.

Frequently asked questions

Is ~all bad?

Not bad, but soft. ~all (softfail) tells receivers that unlisted servers are probably not authorized, but to accept the mail anyway, usually with a small negative mark. It's a sensible default while you're still finding all your senders, but -all is stronger once you're confident.

Should I use -all or ~all?

Use ~all while you're still verifying every legitimate sender, then move to -all (hardfail) once you're confident the record is complete. With DMARC at enforcement the practical difference shrinks, but -all is the cleaner end state.

What does +all do in SPF?

+all tells the world that any server may send as your domain — it effectively disables SPF and invites spoofing. Never use it.

Check your SPF qualifier in seconds

StopForge's free exposure scan reads your live records and shows exactly where your email authentication stands — what passes, what silently fails, and whether anyone can still send as your domain. No changes to your mail, no obligation.

See if your domain can be spoofed

← All guides