All questions
Q & A Email Auth · August 12, 2026

What is the difference between ~all and -all?

~all (SoftFail) means: IPs not in the SPF list should be treated as suspicious but not outright rejected — receiving servers typically deliver to spam. -all (Fail) means: IPs not in the SPF list should be rejected. For domains with DMARC p=reject, the difference matters less since DMARC handles the enforcement. For domains without DMARC, -all provides stronger protection.

Read the full guide
What Is an SPF Record? Sender Policy Framework Explained
SPF tells the world which servers are allowed to send email on behalf of your domain. A missing or misconfigured SPF record lets spammers forge your address — and sends your legitimate email straight to spam.
Related questions
Can I have two SPF records? Does SPF protect the From: address users see? How do I combine SPF for multiple email providers? How do I set up SPF for Google Workspace? How do I set up SPF for Microsoft 365?