Reviewed by: QuickDMARC Security Team · Email Authentication Specialists ·

SPF Hardfail

SPF hardfail (-all) declares that hosts not matching earlier mechanisms should fail SPF evaluation—the strongest common default qualifier.

Example

Use -all when your sending inventory is known. Combine with DMARC for reporting and From-domain policy.

v=spf1 include:spf.protection.outlook.com -all

Operational caution

Missing an ESP include with -all causes SPF fail for that traffic. Fix inventory before flipping from ~all.

How QuickDMARC helps

Aggregate DMARC data shows which sources still need SPF authorization before you harden -all and DMARC reject.

Frequently asked questions

Does -all stop spoofing alone?

It influences SPF result; DMARC policy is what asks receivers to quarantine/reject on DMARC fail.

Can I use ?all?

?all is neutral and rarely useful for production brands.

M365 default?

Microsoft documents include:spf.protection.outlook.com with a terminal qualifier you choose carefully.

Related resources