?all -all and ~all in DNS (spf) configuration

Question

I tried to configure/authenticate my domain DNS with email marketing services. To authenticate SPF I need to add some code.

I want to use various services and in the TXT instructions they provide, at the end, some use -all, others ~all, and some ?all.

For example:

v=spf1 include:spf.mailjet.com include:spf.sendinblue.com mx ~all

I wonder if two such records are mutually exclusive and what are the differences of ?all, -all and ~all?

Jessee

Answer 1

The all mechanism is the last one listed in an SPF record, and tells a checker what to do if no other mechanisms have matched the incoming IP. -all means the default result is a hard failure, ~all means "softfail", means to convey that it's not a pass, but not a hard rejection either (perhaps an indication you should put it in a spam folder - though that should be DMARC's decision). ?all means it's "neutral", which is the same as not having anything at all.

When a service like that recommends ?all, they are being super-conservative and don't want to add any kind of risk - it's a "fail safe" option, providing minimum disruption, but also no protection. I'd say this is counterproductive and simply ends up letting forgeries happen, defeating the whole point of using SPF at all. See my own service's recommendations.

"The right way" is to use a ~all default, and to configure your DMARC record to require both DKIM and SPF "pass" results. There is a historical reason for this: early SPF filter implementations would stop email processing altogether if they encountered a -all, and DMARC processing would not get a chance to do its thing, so it is safer to give a softfail, and then have DMARC consider that a failure.

In short, if you're not using DMARC, aim for -all, if you are, use ~all.

Nedry

can you just explain what "and tells a checker what to do if no other mechanisms have matched the incoming IP" means a bit more? Does it mean no other bulk mail provider would be able to pass or use this domain if this record doesn't pass? Like a limitation of only one allowed provider? – Opprobrium

Anything that doesn’t match any of the other rules is handled by that last “all” rule. You can include as many senders as you like, so long as you stay inside the 10 total lookups limit. – Nedry