SPF SoftFail
Your SPF record ends in `~all` (soft fail). The sender isn't authorized, but the receiver is being told to accept the mail anyway.
SoftFail doesn't block mail, but it's a weak signal. Most receivers treat it as mild negative — mail may land in Promotions or Junk, especially from unknown senders. Also prevents DMARC from passing via SPF alignment.
What causes it
- Your SPF record ends in ~all (recommended default when first deploying SPF, or if you're not fully sure of all your senders).
- You intentionally left SoftFail in place during a migration — but forgot to switch to -all when done.
- A sub-sender in an include: chain uses ~all.
How to fix it
Step 1: Audit your actual senders
List every service that sends mail using your domain. Make sure every one is covered by an include:, a:, mx:, or ip4: mechanism in your SPF record.
Step 2: Tighten to -all
Once you're confident the list is complete, change ~all to -all at the end of your SPF record. This tells receivers to hard-fail unauthorized senders instead of soft-failing.
Warning
Don't switch to -all until you're sure. Switching too early will hard-fail legitimate mail you forgot about (that mail-merge tool, the invoice service, a CI/CD job that sends email).
Fixed it? Run a fresh test to confirm.
Test my inbox →