36

Or put another way, is using v=spf1 a mx ~all recommended over using v=spf1 a mx -all? The RFC does not appear to make any recommendations. My preference has always been to use FAIL, which causes problems to become apparent immediately. I find that with SOFTFAIL, incorrectly configured SPF records are allowed to persist indefinitely, since no one notices.

All of the examples I have seen online, however, seem to use SOFTFAIL. What made me question my choice was when I saw the Google Apps instructions for configuring SPF:

Create a TXT record containing this text: v=spf1 include:_spf.google.com ~all

Publishing an SPF record that uses -all instead of ~all may result in delivery problems. See Google IP address ranges for details about the addresses for the Google Apps mail servers.

Are the examples being overly cautious by pushing the use of SOFTFAIL? Are there good reasons that make the use of SOFTFAIL a best practice?

Improve this question
1

4 Answers 4

Reset to default
24

Well, it was certainly not the intent of the specification for it to be used instead - softfail is intended as a transition mechanism, where you can have the messages marked without rejecting them outright.

As you've found, failing messages outright tends to cause problems; some legitimate services, for example, will spoof your domain's addresses in order to send mail on behalf of your users.

Because of this, the less draconian softfail is recommended in a lot of cases as a less-painful way to still get a lot of the help that SPF offers, without some of the headaches; recipient's spam filters can still take the softfail as a strong hint that a message may be spam (which many do).

If you're confident that no message should ever come from a node other than what you've specified, then by all means, use fail as the SPF standard intended.. but as you've observed, softfail has definitely grown beyond its intended use.

Improve this answer
3
  • 2
    So, unless I have specific circumstances requiring the use of SOFTFAIL, it is safe to stick with FAIL. Awesome. Thanks.
    – Michael Kropat
    Feb 2, 2012 at 19:32
  • 1
    @Shane, Regarding "some legitimate services will spoof your domain's addresses" (paragraph 2), what are some examples that you were referring to?
    – Pacerier
    Jul 23, 2014 at 8:17
  • 1
    Spoofing the Header From: is fine. No legitimate service will spoof the envelope-From, which is the only sender about which SPF has anything to say - no other server on the internet has any business sending email while directing bounces to me, that being the formal function of the envelope-From.
    – MadHatter
    Dec 22, 2017 at 14:22
9

In my understanding, Google relies not only on SPF, but also on DKIM and ultimately DMARC to evaluate e-mails. DMARC takes into account both SPF and DKIM-signing. If either is valid, Gmail will accept the e-mail but if both fail (or softfail), this will be a clear indication that the e-mail may be fraudulent.

This is from Googles DMARC-pages:

A message must fail both SPF and DKIM checks to also fail DMARC. A single check failure using either technology allows the message to pass DMARC.

I therefore think it would be recommended to use SPF in softfail-mode in order to allow it to enter into the greater algorithm of mail analysis.

Improve this answer
4
  • 1
    Very interesting, although I don't see how the conclusion follows from the premises. If DMARC can pass with either an SPF FAIL or an SPF SOFTFAIL, then what does it matter which one you choose?
    – Michael Kropat
    Mar 18, 2015 at 14:54
  • 4
    I think that if you set the SPF record to FAIL, it won't even make it to the DMARC evaluation... but I might be mistaken. The specifications are not clear on this...
    – darwin
    Mar 19, 2015 at 11:29
  • ad SPF Fail vs SoftFail: a) it matters to those without DMARC implemented b) even when DMARC passes failing SPF alone can be reason to mark your message as spam while SoftFail wouldn't be the case cet. par.
    – Vlastimil Ovčáčík
    Apr 22, 2018 at 22:18
  • ad SPF Fail prevents DMARC eval: if implemented the DMARC is always evaluated because a) if SPF and/or DKIM passes DMARC needs to check alignment b) if both fails DMARC needs to update failure report statistics.
    – Vlastimil Ovčáčík
    Apr 22, 2018 at 22:26
8

-all should always be used NO EXCEPTION. To not use it is opening yourself up to someone spoofing your domain name. Gmail for instance has a ~all. Spammers spoof gmail.com addresses all the time. The standard says we must accept emails from them because of ~all. I personally don't follow the standard on this, because i've realized most of you have setup your SPF records incorrectly. I enforce ~all, ?all, just as i would -all. SPF Syntax SPF mistakes

Improve this answer
3
  • 5
    I second this opinion. For me the only reason for Softfail are testing purposes. If you keep your SPF record up to date there is no reason for using a softfail. If you don't, there is no reason for SPF at all. I don't think any legitimate service should fake their email as coming from your domain.
    – Tim
    May 18, 2016 at 11:16
  • I would challenge this: because it depends. If everyone using this domain knows the implications this is absolutely fine. But do not forget: messages from website contact forms might get lost without anyone noticing. Often these messages are set up to forward your message via mail on behalf of you. BUT if you are setting up mail for someone else, don't do it. They don't know about contacts forms not going through and it prevents them to set up the mail address as a convinient alias at some other provider, e.g. gmail.
    – wedi
    Nov 24, 2018 at 6:00
  • 1
    This answer is misguided. Firstly, SPF alone doesn't protect you from address spoofing at all. SPF only checks the sender/return-path address (which is invisible to the recipient), not the visible 'from' address. So a spammer can easily pass SPF and still spoof your address in the from header, regardless of whether you use ~all or -all. You need to use DMARC to protect spoofing of the visible address. Again, with DMARC, it doesn't really matter whether you use ~all or -all, as both can be interpreted as a fail.
    – Kal
    Feb 11, 2020 at 0:35
1

Maybe the reason softfail is still used is that many users (rightly or wrongly) setup forwarding, maybe from their work email to home, this would get rejected if hardfail is enabled

Improve this answer
3
  • 2
    If they do that against the advice of the mail administrators, they deserve to have their email fail.
    – MadHatter
    Jun 6, 2016 at 14:40
  • 1
    @MadHatter forwarded emails have their envelope sender preserved, so it would be the origin's SPF record that would be checked (and most likely fail) not the employer's SPF record. If the employer's mail server updates the envelope sender than it would be updated to a value that wouldn't fail as there would be no difference between forwarded and normal outbound mail (as far as SPF is concerned).
    – Vlastimil Ovčáčík
    Apr 22, 2018 at 22:51
  • 1
    @VlastimilOvčáčík you are right, or to put it another way, if you forward with SRS you'll be fine. If you don't, you won't, and eschewing -all simply to help other people's broken (ie, non-SRS) forwarding setups is not a good idea.
    – MadHatter
    Apr 23, 2018 at 5:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.