What are the advantages and disadvantages of using Fail vs. a SoftFail in my SPF record?
What I found on the topic
This forum post calls SoftFail "wrongly configured", but then says that Google uses it. I trust Google for best practices more than a random forum poster! I checked and indeed, Gmail uses
~all (a SoftFail) in their SPF record.
On the sender end of things, email deliverability experts seem to encourage using SoftFail:
Fail "is more aggressive [than SoftFail] and is known to create more issues than it solves (we don’t recommend it)."
That's rather vague.
"I generally recommend publishing
~allrecords for my clients. There’s not a huge benefit to publishing -all and sometimes mail gets forwarded around. The one time I recommend a -all record is when a domain is getting forged into spam. Domain forgery can cause a lot of bounces. The amount of bounces can be bad enough to take down a mail server, particularly those with a small userbase. Many ISPs will check SPF before sending back a bounce and so a -all record can decrease the amount of blowback the domain owner has to deal with."
—Email deliverability consultants Word to the Wise
Yet how will a webmaster know if there is a substantial amount of domain forgery going on? Isn't a best practice to prepare for the worst and anticipate forgery in advance?
On the receiving end, Terry Zink, who works in enterprise spam filtering, offers a strong case for hard Fail to prevent phishing emails from going through, and says most people use SoftFail because organizations are more afraid of emails being lost than about forged emails. What is the likelihood that a forged phishing email which SPF SoftFails actually gets to someone's inbox?