~all
The SPF ending that returns softfail for unlisted IP addresses: the domain believes they are probably not authorized but stops short of a hard fail.
What it means
~all is the ending Google's SPF setup guide uses in its examples. Receivers are told the unlisted sender is probably not legitimate, and RFC 7208 says they should not reject on softfail alone, though they may scrutinize the message more closely.
Under DMARC, a softfail gives no SPF pass, so it counts the same as a fail toward the DMARC verdict. A domain protected by DMARC at p=quarantine or p=reject therefore gains little from moving to -all, while a domain without DMARC relies more on the SPF ending itself.
~all is a sensible choice while a record is new or the list of sending services is still being discovered.
Example
v=spf1 include:spf.protection.outlook.com ~allRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 7208: Sender Policy Framework (SPF), section 8.5rfc-editor.org
- RFC 7208: Sender Policy Framework (SPF), section 4.6.2rfc-editor.org
- Google Workspace Admin Help: Set up SPFknowledge.workspace.google.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes