Softfail (~all) means ‘this IP isn’t authorized but don’t reject it’ — receiving servers typically mark the email as suspicious but deliver it. Hardfail (-all) means ‘reject email from unauthorized IPs.’ Hardfail is safer once you’ve confirmed your SPF record covers all legitimate senders. Never move to -all without testing, as emails from unlisted legitimate servers will be rejected.
All questions