Blog
SPF softfail vs hardfail: ~all or -all?
Reviewed by the Free Domain Mail editorial team · Updated
The final SPF mechanism tells receivers how strongly the domain owner authorizes the listed senders. It should reflect tested reality, not a copied template.
What softfail means
~all marks unlisted senders as a soft failure. It is useful during discovery, but receivers still make their own delivery decision.
Softfail is not a permanent substitute for maintaining an accurate sender inventory.
When hardfail is appropriate
-all states that unlisted systems are not authorized. Use it only after websites, support tools and transactional providers are included.
DMARC alignment and reporting remain necessary because SPF alone does not protect the visible From address.
Common mistakes to avoid
- Changing production DNS before recording the current values.
- Assuming a DNS record guarantees inbox placement.
- Testing before the previous TTL has expired.
Frequently asked questions
Does -all reject every failing message?
No. The receiving system decides how to handle SPF results; DMARC supplies domain-level policy.
Can I publish both ~all and -all?
Use one final all mechanism in the single SPF record.
Technical references
Primary specifications and provider documentation relevant to this guide: