An SPF record ending in ~all is a softfail: mail from servers not listed still gets delivered, just flagged as suspicious. It is a safe default while you build your record, but the stronger end state is -all (hardfail), which tells receivers to reject unauthorized senders outright.
The final mechanism in an SPF record decides what happens to senders that aren’t listed. ~all (softfail) = accept but mark. -all (hardfail) = reject. ?all (neutral) and +all (pass all) offer essentially no protection and should never be used in production.
Switching straight to -all before every legitimate sender is listed will bounce real mail. ~all lets you publish a working record and watch your DMARC aggregate reports to confirm nothing legitimate is failing, before you harden.
Enforce DMARC alongside SPF — DMARC with p=reject is what truly blocks spoofing, and it works even if you keep ~all. Once your reports show all real senders passing SPF and aligning, switch ~all to -all for defence in depth.
Look at the last mechanism in your record:
$ dig TXT yourdomain.com +shortCheck your SPF record now
Open the free SPF checker →No — it is a reasonable, common setting. It just isn’t the strongest. With DMARC at p=reject, ~all is still well protected; -all adds a second layer.
Not fully. SPF breaks on forwarding and only checks the envelope sender. DMARC is what ties authentication to the visible From address and enforces a policy.
