~all or -all? SPF softfail and hardfail explained

The last term in an SPF record says what happens to mail from a server the record does not list. For a domain that sends mail and publishes DMARC, ~all is the right answer, not a stepping stone to -all. Here is why, and when -all is correct.

The four qualifiers

all matches every IP address, so it only does anything when nothing before it matched. Its qualifier decides the result:

-all is fail: this server is not authorised, and the receiver may reject the message outright.
~all is softfail: this server is probably not authorised, but do not reject on SPF alone.
?all is neutral: no statement either way, the same as the record saying nothing about this IP.
+all, or a bare all, is pass: every server on the internet is authorised. Never publish this.

A record with no all and no redirect= ends in neutral for anything it does not list, which is rarely what anyone meant.

What -all actually does

RFC 7208 lets a receiver act on a fail during the SMTP conversation itself, by refusing the message before its content has been sent. At that point DKIM has not been checked, because the signature is in the message the receiver has just declined to accept. DMARC has not been evaluated either, because DMARC needs both results.

So a hardfail can lose a message that DKIM would have authenticated. The usual victim is forwarded or relayed mail, which arrives from a server your record has never heard of but still carries your valid DKIM signature. See why forwarding breaks SPF for how that happens.

A rejection during SMTP also never reaches your DMARC aggregate reports. The evidence you would need to diagnose the loss is the evidence that disappears.

What ~all does

Softfail tells the receiver the server is not listed without asking it to reject on that basis. The RFC says a receiver should not reject on softfail alone. That leaves the decision to DMARC, which sees both results and applies your policy.

With DMARC at p=quarantine or p=reject, an unlisted server sending unsigned mail as your domain fails DMARC and gets your policy applied. The security outcome is the same as with -all. What changes is that mail with a valid DKIM signature from an unlisted server can still pass.

Is -all the goal? No. Hardfail was the only enforcement SPF had before DMARC existed, so it came to be treated as the finish line. M3AAWG's Email Authentication Best Practices holds that a DMARC pass should override an SPF fail, except where a domain declares it sends nothing, and the DMARCbis draft references that same recommendation.

When -all is right

For a domain that sends no mail at all. Parked domains, domains kept only for redirects, and subdomains that should never appear in a From address are all spoofing targets precisely because nobody watches them. Publish:

v=spf1 -all

There is no legitimate mail for a hardfail to lose, so its only effect is to make forgeries fail as early as possible. Pair it with a DMARC record at p=reject.

Does anyone disagree?

Microsoft's guidance prefers -all in some configurations, on the grounds that DMARC policy is effectively ignored for ~all failures when a message carries no DKIM signature at all. That is a real gap, and it closes as soon as every source sending as your domain signs with DKIM. Configure DKIM everywhere and the objection does not apply to you.

What ~all does not change

The qualifier on all has no effect on the DNS lookup count. all never costs a lookup, whatever its qualifier. A record over the ten lookup limit fails with permerror before all is ever reached, so switching between ~all and -all does nothing for a record that is over. Fixing PermError covers that case.

Check which one you publish

Enter your domain to see your record, its all term, and what it costs in lookups. SPF Guru's generated record keeps whichever qualifier you already use.