I've googled around and even tried to find the answer in the RFC to this one.
For this question, let's assume DKIM will always fail and leave it out of the picture.
If the DMARC policy is p=reject
and the SPF is configured to SoftFail (~all
), should the recipient reject the message in the event of a SoftFail?
Or should p=reject
only reject the message in the event of a HardFail.
Pass
result will negate thep=reject
DMARC policy. That said, indeed, there are no hard and fast rules on how to treat hard and soft fail results for SPF in itself. The RFC states on [Hard] Fail, section 8.4: "Disposition of SPF fail messages is a matter of local policy."