SPF fix
SPF Softfail (~all) vs Hardfail (-all) — What to Use
Pick ~all while you’re still testing who sends as you — flip -all when you trust the list; softfail tags strangers, hardfail drops them.
Why softfail trips people up
- ~all: Strangers look suspicious; mail often still lands. DMARC can still pass on legit mail.
- -all: Strangers fail SPF hard; receivers may drop them.
- +all: Never — you just authorized the whole internet.
When you’re ready for hardfail
Stay on ~all until DMARC reports show every real sender passing SPF. Then flip -all and watch bounces for a week.
Creep the policy safely
Run DNS Preflight to see your SPF ending and lookup tree
Open DNS Preflight →FAQ
What is the difference between ~all and -all?
~all = softfail (suspicious). -all = hardfail (should fail). Pick -all only when your SPF list is complete.
Should I use -all for maximum security?
Not yet — -all drops mail from any IP you forgot to list. Bake the list first, then switch.
Does ~all affect DMARC enforcement?
No — p=reject still wins when alignment fails. SPF ending is a separate lever.
What does +all do?
Passes everyone. That’s not security — delete it.
How do I know when it is safe to switch to -all?
After a few weeks of clean DMARC reports: every legit sender shows SPF pass. Then flip and watch for surprise bounces.