Use -all once your SPF record lists every legitimate sender and you also publish DKIM and DMARC. Use ~all while you are still discovering senders. Under DMARC the difference matters less than people expect, because DMARC evaluates SPF and DKIM together rather than trusting the SPF verdict alone.
What the two endings say
The all mechanism always matches, so it sits at the end of the record as the default. The qualifier in front of it decides the result for any sender not matched earlier.
-allgives a fail: an explicit statement that the host is not authorized.~allgives a softfail: a weak statement that the host is probably not authorized.?allgives neutral, which says nothing.
RFC 7208 says a receiver SHOULD NOT reject a message based solely on softfail, though it may look at it more closely. For a plain fail, rejection is a legitimate choice, though receivers decide for themselves.
How DMARC changes the picture
DMARC passes when either SPF or DKIM passes and aligns with the From domain. A softfail and a fail are both an SPF failure for DMARC purposes. What differs is how receivers treat the message before DMARC even runs.
Microsoft's guidance for Microsoft 365 domains recommends -all because DKIM and DMARC are also recommended, and the DMARC policy then decides what happens to failing mail. It also notes that DMARC treats both as SPF failures.
The practical consequence: if DKIM is solid, a mis-typed -all costs you little. If DKIM is missing for some sender, -all can turn a forgotten service into rejected mail.
A simple rule
- Starting out, or still inventorying senders:
~all, with DMARC atp=noneand reports switched on. - Inventory complete, every sender signing with aligned DKIM: move to
-all. - Domains that send no mail:
v=spf1 -all. The RFC calls publishing this a well-established best practice.
Do not use ?all or +all in production. A +all record authorizes the entire internet to send as you.
Test before you tighten
Switching the ending is a one-character DNS change, which makes it easy to do carelessly. Before changing it:
- Read a week or more of DMARC aggregate reports and list every source IP that is failing SPF.
- Confirm each legitimate source is either in the SPF record or signs with aligned DKIM.
- Change the record during a quiet period and watch reports for the next several days.
Quick check
Does ~all stop spoofing?
Not by itself. It tells receivers that unlisted hosts are probably unauthorized, which is a weak signal. A DMARC policy of quarantine or reject is what asks receivers to act on failures.
Can I switch from ~all to -all safely?
Yes, if reports show that all legitimate mail either passes SPF or carries an aligned DKIM signature. If any sender relies on SPF alone and is missing from the record, fix that first.
Sources
Last reviewed: 19 October 2026.
