Reviewed by: QuickDMARC Security Team · Email Authentication Specialists ·

SPF Softfail

SPF softfail (~all) means the IP is not authorized, but the domain owner requests a soft failure rather than a hard fail—receivers often accept and mark the message.

Example

Softfail is commonly used during transitions. It is weaker than -all for spoofing resistance.

v=spf1 include:_spf.google.com ~all

DMARC interaction

For DMARC, SPF must pass (and align). Softfail is not an SPF pass, so it does not help DMARC via SPF.

How QuickDMARC helps

Monitor whether legitimate traffic still depends on softfail outcomes before tightening qualifiers and DMARC policy.

Frequently asked questions

Is ~all the same as -all?

No. -all is fail; ~all is softfail.

Should I keep ~all with p=reject?

DMARC reject can still protect the From domain; SPF softfail remains a weaker SPF stance for non-DMARC paths.

When to switch to -all?

After authorized IPs/includes are complete and monitored.

Related resources