SPF -all vs ~all
Also called: SPF fail, SPF softfail, hardfail
Qualifiers on the catch-all `all` mechanism. `-all` (fail) is an explicit statement that any other host is not authorised, and receivers may reject. `~all` (softfail) is a weaker statement that the host is probably not authorised, and receivers should not reject on it alone.
In plain terms
`-all` means 'nobody else, full stop'. `~all` means 'probably nobody else, but be gentle'.
Why it matters for deliverability
This one character is the difference between an SPF record that enforces something and one that only expresses a preference. Many domains sit on `~all` for years believing they are protected.
What to do about it
- Start on `~all` while you are still discovering legitimate senders.
- Move to `-all` once DMARC aggregate reports show no unexpected sources.
- Do not move to `-all` and a DMARC reject policy in the same change — you will not know which one broke things.
Source
RFC 7208 — Sender Policy Framework
“A "softfail" result is a weak statement by the publishing ADMD that the host is probably not authorized.”
Checked 2026-08-29
Go deeper
Definitions reviewed 2026-08-29. Spotted something wrong? Tell us.
See how your own mail is handled
Run a real message through MailTester and read the authentication results, spam score and delivery signals described on this page against your own domain.