← All insights · Mon, 17 Aug 2026

50.2% of SPF records use ~all (softfail), most email says "maybe"

Among domains that publish SPF, softfail still beats hardfail. What that costs you.

76.9% of domains publish an SPF record. But SPF only bites if it ends in -all (hardfail). Here's how SPF publishers actually terminate their record:

~all, 50.2%
-all, 44.8%
noneall, 2.6%
?all, 2.4%
+all, 0%

~all (softfail, 50.2%) tells receivers "this probably isn't authorized… but deliver it anyway." -all (hardfail, 44.8%) tells them to reject it. Softfail is the safe default that never gets tightened, which means most domains publish SPF that a spoofer can walk straight past. If you own the domain and every legitimate sender is listed, -all is where you want to be.

Free deliverability tools → Check any domain (MX, SPF, DMARC), test your own inbox placement scored out of 100, generate SPF and DMARC records, or run a blocklist check, all free with no signup and nothing stored, at deliverability.mailtester.ninja/tools.

Verify a real address → This is aggregate DNS data. To check whether a specific email address exists and is deliverable, use MailTester Ninja , real-time, nothing stored.

Data: MailTester Ninja Email Infrastructure Index, 50,000 domains, snapshot Mon, 17 Aug 2026 04:18:29 GMT. Reuse freely under CC BY 4.0.

FAQ

What is the difference between ~all and -all in SPF?

~all is softfail (accept but mark) and -all is hardfail (reject unauthorized senders). ~all is more permissive; -all is stricter and better protects against spoofing once all of your legitimate senders are listed.

Data · Email checker · Email verifier · Blocklist checker · Blocklists explained · Widget

Built & updated automatically by MailTester Ninja, the email verifier that stores nothing. DNS-only, aggregate data, no personal information. · JSON API · RSS