SPF ~all or -all: which ending should you choose?

What it means

An SPF record lists the servers allowed to send email for your domain. Its last part, called the "all" mechanism, says what to do with every other server:

• ~all (soft fail): "other servers are probably not mine, treat the email with suspicion".
• -all (hard fail): "other servers are not allowed to send for me".
• ?all (neutral): "I make no statement". It gives almost no protection.
• +all: "anyone can send for me". Never use it.

v=spf1 include:_spf.google.com ~all
v=spf1 include:_spf.google.com -all

Why it matters

• With DMARC in place, the difference is small. Most large mailboxes, like Gmail and Outlook, use your DMARC policy to decide, not the SPF ending alone. An SPF fail or soft fail both count as "SPF did not pass" for DMARC.
• Without DMARC, some servers reject -all failures straight away, while they only mark ~all failures as suspicious.
• If you forgot a sending service in your list, -all can get its emails rejected, especially when they are forwarded or have no DKIM.
• -all tells the world clearly that your list is complete, which helps protect your domain against spoofing.

How to check

• Use the Domain scanner: type your domain at /domain-scanner to read your SPF record and its ending.
• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox or tool you want to check, then open the report. The SPF line shows "pass", "softfail" or "fail" for the server that sent it.

How to choose

Use ~all when

• You are setting things up and not yet sure every service is listed.
• Some of your emails are not signed with DKIM.
• Your emails are often forwarded (for example to university or old ISP addresses) and you have no DKIM to rescue them.

Use -all when

• You have listed every service that sends for you, and checked each one with a test email.
• All of them sign with DKIM on your domain.
• You have DMARC and its reports show no legitimate source failing.
• The domain sends no email at all: then use v=spf1 -all.

How to switch safely

1. Start with ~all and publish a DMARC record with a rua address to receive reports.
2. Read the reports for two to four weeks. Delivmail's paid dashboard includes DMARC monitoring that turns them into a readable list of senders.
3. Add any missing service to SPF, and set up DKIM for it.
4. Change the ending to -all in your DNS provider. Edit the existing record; do not add a second SPF record.
5. Keep watching the reports for a few more weeks.

Remember: the real protection comes from DMARC with a quarantine or reject policy. The SPF ending is a detail compared with that.

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.

Run the Domain scanner again to see the new ending, then send a test email from each of your sending services. Each report should show SPF passing.