Should I use SPF hardfail or softfail with DMARC?
Summary
What email marketers say12Marketer opinions
Email marketer from Mailhardener responds that using a hardfail (-all) is more strict, and instructs the receiver to reject the email if it fails the SPF check. Softfail (~all) is less strict, and instructs the receiver to accept the email but mark it as suspicious. Softfail is generally preferred in conjunction with DMARC, as it provides the DMARC mechanism the opportunity to make the final decision.
Marketer from Email Geeks explains that if you were evaluating only SPF, and DMARC wasn't even a thing, the `-all` would likely be better. But some MBPs will reject as soon as they see a failed `-all` , and never even get to DKIM/DMARC, but some of those providers now are taking effort to stop acting in such a way.
Marketer from Email Geeks explains that if you want to give both SPF and DKIM a chance to contribute to a DMARC pass, don’t use -all in SPF.
Marketer from Email Geeks confirms anecdotally that they had two clients who were told to use hardfail for security reasons and were seeing problems in DMARC reports. This is an issue because a lot of email marketing platforms don't support SPF anymore.
Email marketer from Reddit shares that you should use softfail (~all) because some providers will reject mail as soon as they see `-all` and never even get to DKIM/DMARC.
Email marketer from Word to the Wise responds that SPF `-all` is obsolete in the world of DMARC and to use `~all` outside of rare cases.
Email marketer from EasyDMARC responds that SPF can have 3 different results, Pass, Neutral and Fail. If you want to fail emails that dont match your SPF records then you will need to use hard fail. However EasyDMARC does not recommend doing that. This is because you might be losing emails. Start with soft fail then work your way up.
Email marketer from Reddit recommends using `~all` (softfail) unless you are absolutely certain that every email you send will pass the SPF check, to ensure that legitimate emails are not rejected.
Marketer from Email Geeks recommends soft fail because some MTAs will evaluate SPF hard fail and bounce the message even if it's fully DMARC compliant with DKIM.
Email marketer from StackExchange shares that using `-all` (hard fail) can cause issues with legitimate emails being rejected, especially when forwarding is involved. Softfail (`~all`) is generally recommended for better compatibility and deliverability when using DMARC.
Email marketer from Superuser explains to use softfail. If you use the hard fail then that means that there are possible legitimate emails that are rejected. This is more apparent when you have forwarded emails.
Email marketer from EmailSecurity.org explains that a hard fail (`-all`) tells the receiving server that if an email fails the SPF check, it should be rejected. A soft fail (`~all`) tells the server that the email should be accepted but marked as suspicious. When combined with DMARC, soft fail is usually the safer option to avoid unintentionally blocking legitimate emails.
What the experts say2Expert opinions
Expert from Word to the Wise responds that SPF `-all` is obsolete in the world of DMARC and to use `~all` outside of rare cases.
Expert from Email Geeks states that `-all` is obsolete in the world of DMARC and to use `~all` outside of rare cases.
What the documentation says4Technical articles
Documentation from AuthSMTP explains that 'Soft Fail' is generally recommended rather than the more aggressive 'Fail' to avoid genuine mail being affected by SPF validation errors. 'Soft Fail' instructs receiving servers to accept the email but mark it as possibly originating from an unauthorized source.
Documentation from Microsoft responds that a hard fail means that mail servers that receive messages from your domain that fail the SPF check should reject them. It goes onto say that soft fail is not a best practice so should not be used.
Documentation from DMARC.org shares that SPF `fail` results are not equivalent to DMARC `fail` results. Because of this, using `?all` or `~all` is recommended.
Documentation from RFC Editor (RFC7208) explains that the "-all" mechanism indicates a hard fail, meaning the email should be rejected if it doesn't match the SPF record. The "~all" mechanism indicates a soft fail, meaning the email should be accepted but marked as suspicious. DMARC policies can then use this information to decide how to handle the email, often quarantining it.