Should I change SPF from ~all to -all when using DMARC quarantine?

Summary

The prevailing guidance suggests that while `-all` offers the strongest SPF protection and security when used with DMARC quarantine, it requires careful and meticulous configuration. Experts and email marketers emphasize the importance of thoroughly auditing and authenticating all legitimate sending sources in your SPF record before implementing `-all` to prevent deliverability issues and false positives. A gradual approach, starting with `~all` and actively monitoring SPF reports and DMARC feedback, is widely recommended. Real-world experiences highlight that `-all` can improve email placement but necessitates ongoing maintenance and testing SPF changes is key to making the right change.

Key findings

  • Strongest Protection: `-all` provides the strongest level of protection and security for SPF when combined with DMARC.
  • Requires Meticulous Configuration: Careful and thorough configuration is essential to prevent unintended blocking of legitimate emails.
  • Gradual Approach Recommended: Starting with `~all` and gradually transitioning to `-all` reduces the risk of deliverability issues.
  • Monitoring is Crucial: Actively monitoring SPF records, DMARC reports, and DMARC feedback loops is necessary to identify and address potential problems.
  • Testing Changes: Testing SPF changes makes you understand the impact of the change.

Key considerations

  • Authenticate All Sending Sources: Ensure that all legitimate email sending sources are properly authenticated and included in your SPF record.
  • Regular SPF Audits: Conduct regular audits of your SPF records to verify accuracy and identify any unauthorized sending sources.
  • Monitor DMARC Feedback: Utilize DMARC reports and feedback loops to identify and address any authentication failures or deliverability issues.
  • Gradual Rollout: Implement changes gradually and carefully monitor the impact on email deliverability.
  • Organizational Impact: Consider the impact across different business units, as each unit might have its own requirements.

What email marketers say
11Marketer opinions

The consensus is that while `-all` provides stronger security when used with DMARC quarantine by strictly enforcing SPF, it's crucial to ensure all legitimate email sources are authenticated in your SPF record to avoid deliverability issues. A gradual approach, starting with `~all` and thorough monitoring, is recommended before transitioning to `-all`. Real-world experiences show that `-all` can improve email placement but requires careful maintenance. Testing SPF changes is also essential to understand the impact.

Key opinions

  • Security vs. Deliverability: `-all` offers better security due to strict SPF enforcement, but incorrect setup can severely impact deliverability.
  • Gradual Implementation: A staged approach, starting with `~all` and then moving to `-all`, minimizes the risk of blocking legitimate emails.
  • Monitoring is Crucial: Regularly monitoring SPF records and DMARC reports is essential to identify and resolve deliverability issues.
  • Testing Changes: Testing SPF changes makes you understand the impact of the change.

Key considerations

  • Authentication of All Sources: Verify that all legitimate email sending sources are properly authenticated in your SPF record.
  • DMARC Reporting: Utilize DMARC reports to identify and address any authentication failures.
  • Business Unit Awareness: Take into consideration other business units using email within the organisation before changing to `-all`.
Marketer view

Email marketer from Email Marketing Tips suggests using `-all` only when you are absolutely sure that all of your email sending services are correctly configured in your SPF record. Incorrect configuration can lead to significantly lower email deliverability.

July 2021 - Email Marketing Tips
Marketer view

Email marketer from Reddit mentions that while `-all` is stricter, it's crucial to ensure that all legitimate sending sources are included in your SPF record to avoid deliverability issues. He suggests monitoring SPF results carefully after implementing `-all`.

November 2024 - Reddit
Marketer view

Email marketer from SuperUser shared a real-world experience where switching to `-all` significantly improved email placement for transactional emails but required careful maintenance to ensure all sources were included.

April 2021 - SuperUser
Marketer view

Marketer from Email Geeks explains that an SPF check with ~all that doesn't match will not pass and won't contribute to a DMARC pass. He also mentioned you should be able to keep the ~all.

May 2021 - Email Geeks
Marketer view

Email marketer from Mailhardener Blog recommends a gradual approach: start with monitoring, then move to `~all`, and finally, if confident, switch to `-all`. This reduces the risk of blocking legitimate emails.

December 2021 - Mailhardener Blog
Marketer view

Email marketer from Postmarkapp mentions the value of being strict using a `-all` but only after a slow roll out and consideration for other business units using email in the organisation.

April 2023 - Postmarkapp
Marketer view

Email marketer from Email Security Forum recommends monitoring your SPF records and DMARC reports regularly after making changes. This helps you identify and fix any deliverability issues that may arise.

May 2023 - Email Security Forum
Marketer view

Email marketer from EmailGeeks Forum suggests starting with `~all` when initially setting up DMARC and SPF, then transitioning to `-all` once you're confident that all legitimate sending sources are properly authenticated to prevent false positives and delivery failures.

February 2024 - EmailGeeks Forum
Marketer view

Email marketer from StackExchange suggests that using `-all` is the more secure and recommended option when implementing DMARC, as it strictly enforces the SPF policy. He also notes that `~all` (SoftFail) can lead to inconsistent results.

February 2025 - StackExchange
Marketer view

Marketer from Email Geeks shares an experience where changing to -all for a client resolved Microsoft inboxing issues, though he couldn't confirm it was the sole reason.

January 2023 - Email Geeks
Marketer view

Email marketer from MailChannels stresses testing changes to SPF using tools before switching to -all. This makes you understand the impact of the change.

June 2022 - MailChannels

What the experts say
1Expert opinion

An expert advises that while `-all` provides the strongest SPF protection, meticulous configuration is essential. Thoroughly auditing sending sources and monitoring SPF reports with DMARC feedback are crucial to avoid blocking legitimate emails.

Key opinions

  • Strongest Protection: `-all` offers the strongest protection for SPF.
  • Meticulous Configuration Needed: Careful setup is required to prevent unintended blocking of legitimate email.

Key considerations

  • Auditing Sources: Thoroughly audit all sending sources to ensure they are authorized.
  • Monitoring: Monitor SPF reports and DMARC feedback to identify and address issues.
Expert view

Expert from Word to the Wise advises that while `-all` offers the strongest SPF protection, it requires meticulous configuration. She recommends thoroughly auditing sending sources to avoid blocking legitimate emails. She also suggests monitoring SPF reports and using DMARC feedback to ensure all systems are working correctly.

April 2023 - Word to the Wise

What the documentation says
5Technical articles

Documentation consistently indicates that using `-all` creates a hard fail, instructing recipient mail servers to reject messages failing the SPF check. While offering the strongest authentication and protection against spoofing when paired with DMARC, it requires an accurate SPF record and thorough testing/monitoring to prevent legitimate emails from being rejected.

Key findings

  • Hard Fail: `-all` implements a hard fail, causing rejection of emails failing SPF.
  • Strongest Authentication: `-all` offers the strongest authentication when combined with DMARC.
  • Better Security: `-all` is generally recommended for improved security when using DMARC.

Key considerations

  • Accuracy of SPF Record: Ensure the SPF record is completely accurate to avoid blocking legitimate emails.
  • Testing and Monitoring: Rigorous testing and continuous monitoring are essential to prevent unintended consequences.
Technical article

Documentation from AuthSMTP highlights the importance of a well-defined SPF record in tandem with DMARC. When using a `p=quarantine` or `p=reject` DMARC policy, they recommend `-all` for the strongest authentication.

April 2022 - AuthSMTP
Technical article

Documentation from DMARC.org explains that using `-all` creates a 'hard fail', instructing recipient mail servers to reject messages that fail the SPF check. They recommend this for maximum protection against spoofing once SPF is properly configured.

August 2023 - DMARC.org
Technical article

Documentation from Google Workspace Admin Help notes that while `~all` (SoftFail) is more lenient, `-all` is generally recommended for better security when using DMARC. Ensure your SPF record is accurate to prevent legitimate emails from being rejected.

February 2023 - Google Workspace Admin Help
Technical article

Documentation from RFC 7208 specifies that the `-all` mechanism indicates a hard fail. The mail server should reject the email. It is the most strict policy and should be used with caution.

January 2022 - RFC 7208
Technical article

Documentation from Microsoft Learn says that Microsoft recommends using `-all` to actively reject unauthorized emails when you use SPF with DMARC, but emphasizes rigorous testing and monitoring to avoid impacting legitimate email flow.

June 2022 - Microsoft Learn