What does ~all mean in SPF?

~all (softfail) means mail from servers not in the SPF record should be accepted but marked as suspicious. -all (fail) means it should be rejected. ?all (neutral) makes no assertion.

What is SPF? Sender Policy Framework Explained

SPF (Sender Policy Framework) is a DNS record that specifies which mail servers are authorized to send email on behalf of your domain. Without it, anyone can forge emails that appear to come from your domain.

SPF checks the sending server, DKIM checks the signature, and DMARC decides what happens when either one fails.

How SPF Works

When a receiving mail server gets an email claiming to be from [email protected], it queries the DNS TXT records for example.com and looks for an SPF record. If the sending server's IP is listed, the email passes SPF. If not, it fails.

Email arrives at the recipient's mail server
Server checks DNS for the sender domain's SPF record
Server compares the sending IP against the SPF record
If the IP is authorized, SPF passes. If not, it fails.
The receiving server applies the policy (~all, -all, etc.)

SPF Record Syntax

An SPF record is a TXT record that starts with v=spf1:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Breaking this down:

v=spf1 — SPF version identifier (always this)
include:_spf.google.com — authorize Google's mail servers
include:sendgrid.net — authorize SendGrid's mail servers
~all — softfail for any other server

SPF Mechanisms

Mechanism	Example	Meaning
`ip4:`	`ip4:203.0.113.1`	Authorize a specific IPv4 address
`ip6:`	`ip6:2001:db8::1`	Authorize a specific IPv6 address
`include:`	`include:_spf.google.com`	Include another domain's SPF policy
`a`	`a`	Authorize the domain's own A record IP
`mx`	`mx`	Authorize IPs in the domain's MX records

All Qualifiers

Qualifier	Name	Meaning
`-all`	Fail	Reject email from unauthorized servers (strict)
`~all`	Softfail	Accept but mark as suspicious (recommended)
`?all`	Neutral	No policy — treat as if no SPF exists
`+all`	Pass	Allow all servers — dangerous, never use this

Common SPF Records by Mail Provider

# Google Workspace
v=spf1 include:_spf.google.com ~all

# Microsoft 365
v=spf1 include:spf.protection.outlook.com ~all

# Mailchimp + Google Workspace
v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

# SendGrid
v=spf1 include:sendgrid.net ~all

SPF Limitations

10 DNS lookup limit — SPF allows at most 10 DNS lookups (each include:, a, mx counts). Exceeding this causes a PermError.
Forwarding breaks SPF — When email is forwarded, the forwarding server's IP isn't in your SPF record, so SPF fails. This is why DMARC with DKIM is also needed.
One SPF record per domain — Multiple SPF records cause a PermError. Merge them into one.

Frequently Asked Questions

Do I need SPF?

Yes. Without SPF, anyone can send email that appears to come from your domain. SPF is the first line of defense against email spoofing.

Where do I add an SPF record?

Add a TXT record at your domain root (@) through your DNS provider or registrar. The value is the SPF record string.

How do I know if my SPF is working?

Use the Email Security checker or the TXT record lookup to see your current SPF record.

Check your SPF record →Next: How to set up DMARC →

Try it on your domain

See the theory in practice — run a Email Security Check for your own domain.