Every mechanism carries a qualifier that says what a match means. There are four, and the difference between two of them is smaller in practice than almost everyone assumes.
The four
| Qualifier | Result on match | The domain owner is saying |
|---|---|---|
+ | pass | This host is authorised. The default when no qualifier is written. |
- | fail | This host is not authorised, and I am comfortable with you rejecting. |
~ | softfail | This host is not authorised, but do not reject on my account. |
? | neutral | I am making no assertion whatsoever about this host. |
Qualifiers are almost always seen on the terminal all mechanism, where they set the default for every host the record did not explicitly authorise. So the last few characters of a record carry most of its meaning.
Reading the ending
... -all everything else is unauthorised, and you may reject it ... ~all everything else is unauthorised, but please do not reject ... ?all I decline to say anything about anything ... +all every host on the internet may send as this domain
+all is a catastrophic misconfiguration
It authorises the entire internet. It appears occasionally in records written by someone trying to stop mail being rejected, and it does stop SPF failures — by making SPF meaningless. If you find one, it is the highest-priority finding in any assessment.
?all is nearly as bad and looks more respectable. A neutral result is treated identically to no record at all by RFC 7208 §8.2, so a domain with ?all has done all the work of publishing SPF and gained nothing from it.
The ~all versus -all question
This is the most-asked question about SPF, and the honest answer is that the practical difference is smaller than the discussion around it suggests.
Receivers very rarely reject on a bare SPF failure alone, whichever qualifier produced it. Legitimate mail fails SPF routinely — every forwarded message does — so a receiver that hard-rejected on -all would lose a great deal of wanted mail. In practice a failure is one input among many to a spam decision.
Where the qualifier genuinely matters is under DMARC. DMARC does not care whether SPF returned fail or softfail: both are simply "not a pass", and the DMARC policy decides what happens. So once you have DMARC at enforcement, the choice between ~all and -all stops being the thing protecting you.
- Use
~allwhile you are still discovering senders, or if you have any doubt your inventory is complete. - Use
-allonce you are confident, and particularly on domains that send no mail at all, where it is unambiguous and free. - Never use
?allor+all.
Two real records, both from organisations that take this seriously, landing differently:
cloudflare.com ... -all (checked 2026-09-12) paypal.com ... ~all (checked 2026-09-12)