Why SPF Soft‑Fail (~all) Is the Smarter Choice for Deliverability

When you publish an SPF record with a hard‑fail (-all), you’re telling every receiver to reject mail from any IP not explicitly authorised. It sounds secure—but it can do more harm than good. In many real‑world scenarios, a soft‑fail (~all) policy delivers the same security under DMARC while avoiding collateral damage to legitimate mail flows. Here’s why staying in soft‑fail often makes the most sense.

1. SPF’s Bypass Vulnerability

SPF checks only the envelope sender (MAIL FROM), not the visible “From:” header. An attacker can exploit this by using a domain they control in the envelope, yet spoof your brand in the header—completely bypassing SPF’s intended protection. DMARC addresses this gap by requiring alignment, but it underscores that SPF alone is never a standalone defence.

2. Under DMARC, “Hard” = “Soft”

Once DMARC is active, any SPF result aside from an aligned “pass” will break SPF alignment—whether it’s -all, ~all or ?all. The receiving system then defers to DKIM or DMARC’s own policy (none, quarantine, reject). In practice, hard‑fail offers no extra benefit under DMARC.

3. The Relaying (Forwarding) Problem

Legitimate forwarding or relaying services—common in multi‑domain setups—break SPF. A forwarded email often arrives from an IP not listed in your SPF, triggering a hard‑fail. With -all, that message is bounced before DKIM or DMARC can save it. Soft‑fail, however, allows the mail through for full authentication checks, ensuring genuine mail survives forwarding.

4. RFC‑Mandated Caution on Early Rejection

The DMARC specification warns that a hard‑fail may cause some receivers to reject mail before DMARC and DKIM can be evaluated. You could lose perfectly legitimate, DKIM‑signed messages simply because SPF blocked them too early.

5. Domain Reputation Isn’t Improved by -all

There’s no evidence that hard‑fail boosts your sending reputation—any “reputation” gain from blocking illegitimate mail is outweighed by the spikes in bounces and NDRs you’ll generate. Soft‑fail avoids those bounces, keeps your bounce rate in check, and still provides the same DMARC‑driven security.

6. Recommended Email Hardening Workflow

1. Publish SPF with ~all to collect data without breaking flows.
2. Deploy DMARC (start with p=none), review reports to identify missing senders.
3. Enable DKIM signing for all legitimate sources and ensure alignment.
4. Tighten DMARC to quarantine or reject once DKIM coverage is 100%.
5. (Optional) Switch SPF to -all only if you’re absolutely certain no valid mail will break alignment.

7. When -all Still Makes Sense

For domains that should never send email—such as parked domains or inbound‑only mailboxes—a hard‑fail SPF aligned with a DMARC p=reject policy is appropriate. But for active sending domains, soft‑fail maximises deliverability without compromising DMARC‑backed security.

Conclusion

SPF hard‑fail is a relic from a pre‑DMARC era. Today, with DMARC and DKIM doing the heavy lifting, soft‑fail (~all) gives you the best of both worlds: visibility into unauthorised flows, robust protection against spoofing, and minimal risk of blocking legitimate mail. Start soft, monitor closely, then only tighten when you’ve seen every source through the lens of DKIM and DMARC.