SPF guide

SPF softfail: what it means and how to fix it

Why your email shows spf=softfail, how it differs from fail and neutral, and how to get it passing.

What SPF softfail means

SPF softfail is the result inboxes give when the server that sent an email isn’t listed in your SPF record, and your record ends in ~all. It means “probably not allowed, but don’t reject it”. Most inboxes accept the email but treat it as more suspicious.

In an email’s headers it looks like this:

spf=softfail (domain of transitioning you@yourdomain.com does not designate 203.0.113.10 as permitted sender)

Softfail, fail and neutral

Softfail comes from ~all: accept, but suspicious. The safe, common setting.
Fail comes from -all: reject.
Neutral comes from ?all: no opinion, which protects nothing.

Why your own email gets softfail

A service sending as you isn’t in your SPF record, such as a new newsletter tool or CRM.
Your server’s IP address changed and the old one is still listed.
The email was forwarded, so it arrived from the forwarder’s server.
Your record is over the 10-lookup limit, so later includes are never checked.

How to fix it

Find the sending server. The IP address is in the softfail line of the headers.

Work out which service it belongs to and add its include to your record, or add the IP with ip4:.

Rebuild and count with the SPF record generator, then publish.

Make sure DKIM is on for that service too, so DMARC still passes when email is forwarded.

Check your SPF

See which services your record allows and how many lookups they use.