What are the considerations for using soft fail vs hard fail in SPF policies?
Summary
What email marketers say11Marketer opinions
Email marketer from Reddit suggests setting up DMARC in monitoring mode (p=none) first to gather data before implementing a hard fail in SPF, to avoid unintended consequences with legitimate email sources.
Email marketer from GlockApps explains that any SPF failure (soft or hard) can negatively impact deliverability, but hard fails are more likely to result in immediate rejection. Soft fails might land in spam.
Email marketer from DMARC Analyzer shares that using SPF with a hard fail (`-all`) and DMARC can help prevent spoofing and phishing attacks, but emphasizes the importance of monitoring DMARC reports to avoid false positives.
Email marketer from StackExchange explains, generally speaking a softfail is a warning while a hardfail is an instruction. The actual implementation is up to the receiving server.
Email marketer from MXToolbox explains both softfail and hardfail can lead to deliverability problems. But softfail provides the receiving server with more flexibility.
Email marketer from Mailhardener notes hardfail ensures clear instruction for receivers, but may cause legitimate emails from forwarders or services not in the SPF record to be rejected.
Marketer from Email Geeks shares that hard fail runs the risk of reject before message content can be accepted and parsed for DKIM and DMARC checks.
Email marketer from Mailhardener shares that softfail is more forgiving. Although, can lead to inconsistent deliverability since the handling is left to the recipient server.
Email marketer from Postmark recommends starting with a DMARC policy of `p=none` (monitoring mode) and gradually moving to `p=quarantine` and `p=reject` after carefully analyzing the DMARC reports. Doing this helps you understand the impact of your SPF and DKIM configurations before fully enforcing them.
Email marketer from EasyDMARC mentions that SPF softfail should be used with caution, as the results are unpredictable and are dependent on the receiving mail server’s implementation. Hardfail is more direct, but could negatively impact legitimate emails.
Marketer from Email Geeks references RFC 7208 stating that there should be no rejection solely because of an SPF failure when the SPF record ends in ~all, because that is a softfail.
What the experts say6Expert opinions
Expert from Email Geeks explains that `-all` can sometimes override DMARC and cause blocking before DKIM is checked. He suggests `~all` is better as it passes the blocking question on to the DMARC policy.
Expert from Word to the Wise responds that the main consideration is how strictly you want receivers to treat mail that fails SPF. Using a hard fail (-all) tells receivers to reject the message, while a soft fail (~all) is a suggestion to treat the mail with caution. He recommends using DMARC policy to handle this.
Expert from Email Geeks explains using `~all` encourages mailbox providers to treat SPF records as intended. He adds with SPF and DKIM being positive assertions, negative policy assertions can be cleanly left in DMARC.
Expert from Email Geeks shares a blog post covering SPF all or all updated for 2024.
Expert from Spam Resource shares that you should embrace the tilde (~all). This is because SPF was initially intended to be advisory, and in a perfect world we should allow receivers to handle mail as they best see fit.
Expert from Email Geeks responds that DMARC is the right partial solution to stop unauthorized bulk emails. But only partial, as any random salesweasel can buy spamware, plug in their google apps credentials and spam away, 100% authenticated.
What the documentation says5Technical articles
Documentation from GitHub explains the practical differences between soft and hard fails are small as it's up to the individual mail system's discretion.
Documentation from ietf.org explains that a hard fail (using -all) indicates the mail server believes the IP address is not authorized, and the message should be rejected. This is a strong assertion.
Documentation from Microsoft states that implementing SPF helps prevent spoofing and is an important part of email authentication setup. They don't explicitly recommend soft or hard fail, but emphasize proper configuration to avoid deliverability issues.
Documentation from AuthSMTP advises using a softfail instead of hardfail, because it allows for a more gradual introduction of the SPF policy.
Documentation from ietf.org explains that a softfail (using ~all) indicates that the mail server believes the IP address is not authorized, but is willing to accept the message. It is a weaker assertion than a hard fail.