SPF softfail (<code>~all</code>)
A softfail is what the ~all mechanism produces for
any sender not listed in your SPF record: the mail is marked suspicious but usually still
accepted, often to spam.
What SPF softfail means
The final all mechanism sets the default result for senders that don’t match
anything earlier in the record:
~all— softfail: “probably not authorized.” Accept but treat with suspicion.-all— hardfail: “not authorized.” Reject.?all— neutral: no assertion.+all— pass everything (never use this).
Softfail vs hardfail
~all is the cautious choice: legitimate mail from a forgotten sender lands in spam
rather than bouncing. -all is stricter and better for security once you are
certain every real sender is listed. Many teams start on ~all, confirm
their record is complete and passing, then move to -all.
Softfail and the lookup limit
Note that the all qualifier only matters if your record evaluates successfully.
If you are over the 10-lookup limit, you get a
permerror regardless of whether you used
~all or -all — so fixing the lookup count comes first.
Frequently asked questions
What does SPF softfail mean?
~all) means a sender isn’t listed in the SPF record and should be treated as suspicious — typically accepted but filtered to spam rather than rejected.Should I use ~all or -all?
~all while confirming your record lists every legitimate sender; move to -all for stricter protection once you’re confident it’s complete.