Glossary
SPF SoftFail (~all) — What It Means
SPF SoftFail (~all) is a result returned when a sending IP is not listed in the SPF record, but the domain owner has indicated this should be treated as suspicious rather than a hard failure. Emails that trigger SoftFail are typically delivered but may be marked as suspicious or placed in spam, depending on the receiver's policy and the domain's DMARC configuration.
SoftFail vs Fail vs Pass
- ~all (softfail): not authorised, treat as suspicious
- -all (hardfail/fail): not authorised, reject
- +all (pass): everything passes — never use
- ?all (neutral): no policy — avoid
When to Use ~all
Use ~all while setting up email authentication and monitoring. Switch to -all once all legitimate senders are confirmed in your SPF.
Validate your SPF TXT
Open DNS Preflight →FAQ
What does SPF SoftFail mean?
The sending IP isn't in your SPF record, but you've indicated failures should be treated as suspicious rather than hard failures. Email is usually delivered but may go to spam.
Should I use ~all or -all?
Start with ~all while monitoring. Switch to -all once all your legitimate senders are in your SPF record and verified clean.
Does SPF SoftFail affect DMARC?
SoftFail counts as SPF failure for DMARC alignment purposes. DMARC can still pass if DKIM alignment passes.