~all versus -all

Q: What do ~all and -all request?

-all is fail: RFC 7208 §8.4 calls it “an explicit statement that the client is not authorized to use the domain”. ~all is softfail, §8.5, “Receiving software SHOULD NOT reject the message based solely on this result”. Both are requests, not instructions.

Q: Which should my domain use?

-all once you can name every sender, ~all until then. The qualifier is a claim about completeness, and publishing -all on an incomplete list makes a false one.

Q: What do ?all and +all mean?

?all is neutral: it asserts nothing, and is treated much like having no policy. +all authorises every host on the internet and should essentially never be published.

Q: How does the qualifier interact with DMARC?

DMARC needs an SPF pass with an aligned domain. Softfail is not pass, so ~all gives DMARC nothing on the SPF side for an unlisted sender — the same as -all in that respect.

Q: How do I move from ~all to -all safely?

Inventory first. Publish DMARC with a rua address, read the reports until no unrecognised source appears across a full sending cycle including monthly and quarterly jobs, then change the character.

The qualifier at the end of your record says what you are asking receivers to do about senders you did not list. ~all is softfail, -all is fail, and neither obliges anyone to do anything. This page covers what each one states in RFC 7208, how DMARC treats them differently, and how to move from one to the other without discovering a sender you forgot.

Measured 2026-09-08: 162 of 320 audited domains (50.62%) chose to end their record in ~all. These are domains someone had a reason to check, so this is an upper bound and not an internet-wide rate — method, window and exclusions in SPF Observatory 2026.

What was observed

Your record ends in ~all, -all, ?all or +all — or, occasionally, in nothing at all.

What causes it

These are protocol and measurement causes only. We do not speculate about what a receiver did with the result.

~all is the default most setup wizards publish, and it is rarely revisited.
?all is sometimes left behind after testing; it asserts nothing.
+all authorises every host on the internet and is almost always a mistake.

How to verify it yourself

Read the qualifier at the end of your record

dig +short TXT example.com | grep -o '[-~?+]all'

Check this record Reads the live record and counts every DNS lookup it costs.

The safe fix, and what it can break

Move to -all only after the sender inventory is complete. Publish ~all with a DMARC rua address, read reports until no unexpected source appears for a full sending cycle, then change one character.

What can break: -all is a stronger statement about mail you did not send, and about mail you did send from somewhere you forgot. Forwarding is the other case: a forwarder relays your message from its own address, so SPF evaluates the forwarder and fails. DKIM survives forwarding where SPF does not, which is why DMARC accepts either.

Examples

Softfail — the common default

v=spf1 include:_spf.google.com ~all

Fail — a complete inventory

v=spf1 include:_spf.google.com -all

Neutral — asserts nothing, rarely useful

v=spf1 include:_spf.google.com ?all

Authorises everyone — almost always wrong

v=spf1 +all

What the standard says

RFC 7208 §8.5: “Receiving software SHOULD NOT reject the message based solely on this result”

What do ~all and -all request?

-all is fail: RFC 7208 §8.4 calls it “an explicit statement that the client is not authorized to use the domain”. ~all is softfail, §8.5, “Receiving software SHOULD NOT reject the message based solely on this result”. Both are requests, not instructions.

Which should my domain use?

-all once you can name every sender, ~all until then. The qualifier is a claim about completeness, and publishing -all on an incomplete list makes a false one.

Does -all break forwarded mail?

SPF fails on forwarded mail either way, because the forwarder relays from its own address. -all states that more strongly. DMARC passes such mail on DKIM instead, which is why a DKIM signature matters more than the qualifier here.

What do ?all and +all mean?

?all is neutral: it asserts nothing, and is treated much like having no policy. +all authorises every host on the internet and should essentially never be published.

How does the qualifier interact with DMARC?

DMARC needs an SPF pass with an aligned domain. Softfail is not pass, so ~all gives DMARC nothing on the SPF side for an unlisted sender — the same as -all in that respect.

Does it affect DKIM-signed mail?

No. DKIM is evaluated independently, and DMARC passes if either mechanism passes with alignment. A DKIM-signed message survives an SPF fail.

How do I move from ~all to -all safely?

Inventory first. Publish DMARC with a rua address, read the reports until no unrecognised source appears across a full sending cycle including monthly and quarterly jobs, then change the character.

What is the difference between SPF fail and DMARC fail?

SPF fail is one mechanism's result. DMARC fail means neither SPF nor DKIM passed with alignment. A message can fail SPF and pass DMARC on DKIM, which is the normal case for forwarded mail.

What we do not claim

We report what your DNS publishes and what an evaluator would return from it. We do not state what any mailbox provider will do with that result: those decisions are theirs, they are not published, and we cannot measure them from here.

Reviewed by Venkat Nookala, last reviewed 2026-09-08.