In an SPF record, every mechanism carries a qualifier that defines the result if that mechanism matches. The four qualifiers in RFC 7208 are + (pass, the default), - (fail), ~ (softfail) and ? (neutral). They matter most on the catch-all all mechanism at the end of the record, which decides how to handle any sender not explicitly authorised.
-all (hardfail) is the strict, recommended setting: it states that only the listed sources may send for the domain, and everything else should fail. ~all (softfail) marks unlisted mail as suspicious but not an outright failure, which is useful while testing before tightening up. ?all (neutral) makes no assertion, and +all authorises the entire internet, which is dangerous and should never be used.
Qualifiers matter because they shape both deliverability and DMARC: a hardfail combined with DMARC enforcement is what actually stops spoofing of your domain. A softfail leaves a gap attackers can exploit.
To check yours, look up your TXT record and inspect the final mechanism. Begin with ~all while confirming all legitimate senders are covered, then move to -all once your sending sources are complete and verified.
Check it on your domain
- SPF Checker: validates SPF and counts DNS lookups against the limit of 10.
- SPF Generator: generates an SPF record from your list of senders.