SPF qualifier

What it means

Every SPF mechanism can carry a qualifier. When the mechanism matches the sending IP address, evaluation stops and the qualifier becomes the result: + gives pass, - gives fail, ~ gives softfail and ? gives neutral. With no qualifier the default is +, so include:example.net and +include:example.net mean the same thing.

The closing all mechanism is where a qualifier matters most, since it expresses the domain's policy for every address not listed. A qualifier on another mechanism is legal and occasionally useful, for example -ip4:192.0.2.66 to exclude one address inside a network that a later term authorizes.

Receivers apply their own policy to each result. RFC 7208 leaves the handling of fail to local policy, says not to reject on softfail alone, and requires neutral to be treated exactly like none.