SPF hard fail (<code>-all</code>)
A hardfail is the result of the -all mechanism:
any sender not explicitly authorized in your SPF record should be rejected. It
is the strictest, most secure setting — and the least forgiving of an incomplete record.
What SPF hardfail means
-all at the end of your record tells receivers: “I have listed every server
allowed to send as this domain; reject anything else.” This is what you want for maximum
protection against spoofing and for a strong DMARC posture — provided your record
truly lists every legitimate sender.
The risk of hardfail
If a real sender is missing from your record — a newly added marketing tool, a provider
whose IPs changed, or a sender dropped when you were fighting the
10-lookup limit — -all causes that
legitimate mail to bounce. This is exactly why static flattened
records are risky: a stale record plus -all equals rejected mail. A
self-healing record keeps the authorized list complete so -all stays safe.
Hardfail vs softfail
See SPF softfail (~all) for the cautious alternative.
The usual path: run ~all until your record is provably complete and under the lookup
limit, then switch to -all.
Frequently asked questions
What does SPF hardfail (-all) mean?
Is -all or ~all better?
-all is more secure; ~all is safer against accidental rejection. Move to -all only once you’re sure every legitimate sender is authorized and the record is under the lookup limit.