SPF Softfail Explained: What ~all Really Means
SPF softfail (~all) marks unauthorised senders without hard-failing them. Learn how receivers treat softfail, when to use it during migration, and how to move to -all without breaking mail.
An SPF softfail is the result produced when a message’s sending IP is not authorised by your SPF record and the record ends with ~all. Receivers are told "this looks suspicious" rather than "reject as a hard fail" (-all). Softfail is a migration tool, not a permanent security posture.
For full SPF syntax and the ten-lookup limit, use the SPF record guide. This article stays on ~all behaviour and the path off it.
~all vs -all vs +all
- `~all` (softfail) — unauthorised IPs fail softly; many receivers still accept the message, sometimes with spam scoring.
- `-all` (fail) — unauthorised IPs hard-fail SPF; preferred once your sender inventory is complete.
- `+all` — authorises the world; never use it on a production domain.
v=spf1 include:_spf.google.com include:sendgrid.net ~all
How softfail interacts with DMARC
DMARC can still pass via aligned DKIM even when SPF softfails. Conversely, SPF softfail with no aligned DKIM contributes to DMARC failure. Leaving ~all forever while you run p=none trains you to ignore spoofing. Read DMARC policy explained before you assume softfail is "safe enough."
Use ~all only while you discover forgotten ESPs. Schedule a date to flip to -all once reports and tests are clean.
Migration path off softfail
- 1Inventory every sender; fix includes until legitimate mail SPF-passes.
- 2Watch DMARC aggregate reports for sources that still fail SPF.
- 3Flip the record to
-allin a single deliberate change window. - 4Verify with the DMARC checker and real outbound tests.
Softfail buys time; it does not buy protection. Treat ~all as scaffolding, finish the SPF record guide inventory, then lock the policy with -all so DMARC enforcement rests on a real allow-list.
