Should my SPF record end in ~all or -all?

For a domain that sends mail and has DMARC enforced, use ~all (soft fail). RFC 9989 warns that -all can cause receivers to reject a message on SPF alone, before DKIM or DMARC are evaluated, and that such rejections never appear in DMARC aggregate reports. For a parked domain that never sends mail, -all is correct because there is no legitimate mail to lose.

Does using ~all instead of -all weaken my DMARC protection?

No. With DMARC at p=reject, DMARC makes the final decision. Spoofed mail fails both SPF and DKIM alignment and is rejected regardless of whether the SPF record ends in ~all or -all. The qualifier changes visibility, not protection: -all can cause rejections to happen before DMARC runs, so they are never reported.

Why does an SPF -all hide failures from DMARC reports?

SPF is checked early in the SMTP transaction, on the envelope sender, before the message body is transmitted. A receiver that rejects at that point never reaches the DATA phase, so it never sees the From header, never discovers the DMARC policy, and never generates an aggregate report entry for that message. The mail is lost and so is the evidence.

How many Australian domains use -all versus ~all?

In DMARC Busta's March to June 2026 scan of 10,409 Australian organisation domains, 62% of valid SPF records ended in -all and 36% in ~all. Among domains at p=reject the split was 65% to 32%. Both groups reject spoofed mail equally well once DMARC is enforcing; the qualifier is not what gets a domain to enforcement.

Why DMARC Busta writes ~all, not -all

Hard-fail SPF is the convention. The DMARC standard says it's the wrong default for a domain that sends mail.

There's a debate running this month on r/DMARC and in MSP communities about whether an SPF record should end in -all (hard fail) or ~all (soft fail). The conventional advice, repeated by most DMARC vendors and most AI assistants, is: start with ~all, and "graduate" to -all once every legitimate sender is in the record.

The current DMARC standard disagrees. Here's what it says, what our scan of Australian domains shows, and what Autopilot does about it.

What the Standard Says

RFC 9989, published in May 2026 and replacing RFC 7489, addresses this directly in its section on SPF (§7.1, "Issues Specific to SPF"). The relevant point: SPF is evaluated early in the SMTP transaction, before the message body arrives. A receiver that acts on -all can reject the message at that point, before DKIM or DMARC are ever evaluated. Two consequences follow.

First, a message that would have passed DMARC through an aligned DKIM signature — forwarded mail is the common case — can be rejected on SPF alone. Second, a message rejected that early never appears in your DMARC aggregate reports, because the transaction never reached the point where the From domain is revealed. You lose the mail, and you lose the evidence that you lost it.

In the RFC's own words:

Domain Owners choosing to use "-all" to terminate SPF records should be aware of this and should understand that messages that might otherwise pass DMARC due to an aligned DKIM-Authenticated Identifier could be rejected solely due to an SPF fail. Moreover, messages rejected early in the SMTP transaction will never appear in aggregate DMARC reports, as the transaction will never proceed to the DATA phase, and so the RFC5322.From domain will never be revealed and its DMARC policy will never be discovered.

— RFC 9989, §7.1

M3AAWG's email authentication best-practice guidance has recommended ~all for sending domains for the same reason.

Why the Distinction Doesn't Matter as Much as People Think — and Why It Does

With DMARC at p=reject, DMARC makes the final decision. Spoofed mail fails both SPF and DKIM alignment and is rejected regardless of which qualifier you chose. So ~all costs you nothing in protection once DMARC is enforcing.

What -all costs you is visibility. The whole point of aggregate reporting is to see what's being rejected and why. A qualifier that causes rejections to happen off the books works against that.

What Australian Domains Actually Do

Between March and June 2026 we scanned 10,409 Australian organisations' domains. Of those with a valid SPF record, 62% end in -all and 36% in ~all. Among domains that have reached p=reject, the split is 65% to 32%.

So hard fail is the convention at every enforcement level. But a third of the domains at p=reject run ~all, and they are rejecting spoofed mail exactly as well as the rest. The qualifier isn't what gets a domain to enforcement — and most domains in that dataset never got there at all. The gap that matters is p=none to p=reject, not ~ to -.

What Autopilot Writes

When Autopilot builds or repairs an SPF record for a domain that sends mail, it writes ~all. For parked domains and domains that never send, it writes -all — there, hard fail is correct, because there is no legitimate mail to lose.

If you have a reason to want -all on a sending domain, you can set it per domain and Autopilot will preserve it. We'd rather you made that choice knowingly than inherited it from a decade-old rule of thumb.

The Short Version

For a sending domain with DMARC enforced: ~all, DKIM on every source, p=reject. For a domain that never sends: -all. Everything else is convention.

Not sure what your own record ends in, or whether DMARC is actually enforcing? Run the free scan — it takes about ten seconds and reads the live DNS.

References and Further Reading

RFC 9989 — Domain-based Message Authentication, Reporting, and Conformance (DMARC), §7.1 "Issues Specific to SPF" (May 2026; obsoletes RFC 7489 and RFC 9091)
M3AAWG Email Authentication Recommended Best Practices (September 2020)
DMARC Busta — The State of DMARC in Australia 2026: the scan dataset behind the figures above, with a downloadable anonymised CSV
DMARC Busta — DMARCbis is now official: RFC 9989, 9990 and 9991
DMARC Busta — Your DMARC Pass Rate Says 41%. Nothing Is Broken. Here's Why.
DMARC Busta — The DKIM gap: 29.5% of Australian DMARC records are doing less than people think

Dataset figures come from DMARC Busta's scan of Australian organisation domains between March and June 2026 (10,409 completed scans). Percentages are of domains with a syntactically valid SPF record and are point-in-time; the anonymised dataset is available on the research page. The Autopilot behaviour described is current as of September 2026.