SPF Softfail vs Hardfail: Understanding SPF Results and When to Use Each

Email Authentication

Your SPF record's "all" mechanism determines what happens when an email comes from an IP not explicitly listed. The difference between softfail (~all) and hardfail (-all) can significantly impact both security and deliverability.

SPF Results Explained

When a receiving server checks SPF, it gets one of these results:

The "all" Mechanism

The all mechanism at the end of your SPF record is a catch-all for IPs not matched by previous mechanisms.

Hardfail: -all

v=spf1 include:_spf.google.com -all

The -all hardfail means: "Any IP not listed should be considered unauthorized. Reject these emails."

Pros:

• Strongest protection against spoofing
• Clear signal to receivers about unauthorized mail
• Recommended for domains with well-documented sending infrastructure

Cons:

• Legitimate emails from unlisted sources will fail
• Can cause problems if you miss a sending service
• Less forgiving of configuration mistakes

Softfail: ~all

v=spf1 include:_spf.google.com ~all

The ~all softfail means: "IPs not listed are probably not authorized, but don't reject—flag for review."

Pros:

• More forgiving during SPF configuration
• Doesn't immediately break legitimate emails from missed sources
• Gives you time to identify all sending sources

Cons:

• Weaker protection against spoofing
• Some spam may slip through
• Can be seen as incomplete configuration

Neutral: ?all

v=spf1 include:_spf.google.com ?all

The ?all neutral means: "I'm not making any assertion about IPs not listed."

Pros:

• Maximum flexibility
• Won't break any email

Cons:

• Provides almost no protection
• SPF might as well not exist
• Not recommended for production use

When to Use Each

Use Softfail (~all) When:

1. Setting up SPF for the first time — You might not know all sending sources yet
2. Adding new email services — Test before committing to hardfail
3. Managing a domain with many senders — Complex environments need flexibility
4. Not fully confident in your configuration — Better to flag than reject

Use Hardfail (-all) When:

1. You've fully documented all sending sources — You know exactly who sends as your domain
2. You want maximum spoofing protection — Security is the priority
3. You've tested thoroughly with softfail — No legitimate mail is failing
4. DMARC is configured with enforcement — Defense in depth

Never Use Neutral (?all)

There's almost no valid use case for ?all in production. It provides no protection and signals to receivers that you haven't properly configured SPF.

Understanding Permerror and Temperror

Permerror (Permanent Error)

A permerror occurs when the SPF record has a fatal flaw:

Common causes:

• More than 10 DNS lookups
• Syntax errors in the record
• Invalid mechanisms
• Circular includes

# Too many lookups causes permerror
v=spf1 include:a.com include:b.com include:c.com include:d.com
       include:e.com include:f.com include:g.com include:h.com
       include:i.com include:j.com include:k.com -all

Fix: Reduce lookups, fix syntax, or flatten your SPF record.

Temperror (Temporary Error)

A temperror occurs when DNS can't be reached temporarily:

Common causes:

• DNS server timeout
• Network connectivity issues
• DNS propagation in progress

What happens: Most receivers will retry later or treat as neutral.

SPF and DMARC Interaction

Your SPF result affects DMARC evaluation:

Migration Path: Softfail to Hardfail

Real-World Examples

E-commerce Business

v=spf1 include:_spf.google.com include:sendgrid.net include:shopify.com -all

Uses hardfail because:

• All sending sources are known (Google Workspace, SendGrid for marketing, Shopify for orders)
• Security is important for customer trust
• Configuration has been tested thoroughly

Startup in Transition

v=spf1 include:_spf.google.com include:mailchimp.com ~all

Uses softfail because:

• Still adding new tools and services
• Not yet confident all sources are documented
• Will switch to hardfail after audit

Enterprise with Complex Infrastructure

v=spf1 include:_spf.enterprise.com ~all

Uses softfail because:

• Many departments send email
• Mergers and acquisitions add complexity
• Risk of breaking legitimate email is high

Best Practices

1. Never use +all — This authorizes the entire internet to send as your domain
2. Avoid ?all in production — It provides no protection
3. Use ~all during setup — Move to -all when ready
4. Monitor with DMARC — Get visibility into SPF failures
5. Document all senders — Know exactly who sends as your domain
6. Test before changing — Verify configuration before switching to hardfail

The choice between softfail and hardfail isn't permanent—you can change it as your needs evolve. Start safe with softfail, build confidence through monitoring, and graduate to hardfail when you're ready for maximum protection.

Related Articles