auth.spf.softfail_all

SPF Soft-Fails Unauthorized Senders (~all)

What we check

We read the qualifier in front of the SPF record's final all mechanism. ~all (softfail) is the value this finding reports. It is informational: it costs no points, but the verdict line and the evidence table judge the qualifier, so the finding says what they are looking at.

What this finding means

A softfail tells receivers that mail from a server the record does not list is probably not authorized, without asking them to reject it. Most receivers deliver such mail with a lowered reputation, and DMARC treats softfail as an SPF failure for alignment purposes, so under p=quarantine or p=reject the difference between ~all and -all is largely academic.

Why it matters

• Without DMARC enforcement, ~all blocks nothing. Receivers are only asked to be suspicious; forged mail from an unlisted server still lands, usually in the inbox.
• With DMARC enforcement, ~all is the safer rollout choice. Forwarded mail that breaks SPF still has a chance through DKIM, which is why many providers recommend ~all until every stream is aligned.
• -all is the end state. Once every legitimate sender is listed and the aggregate reports are clean, a hard fail is what the record is for.

How to fix

1. Check the aggregate reports (rua=) for legitimate senders that still fail SPF and add them.

2. Move to a hard fail once the reports are clean:

   copy

   example.com.  IN  TXT  "v=spf1 ip4:192.0.2.10 include:_spf.provider.example -all"
   

3. Keep DMARC enforcing (p=quarantine or p=reject); that is what makes the SPF result matter.