Finding: SPF Set to Soft Fail
This finding means your domain publishes a single SPF record ending in ~all (soft fail). Unauthorized mail is asked to be treated as suspicious rather than rejected, and most receivers still deliver it — usually to spam.
Last updated August 11, 2026.
What it means
The final mechanism in an SPF record tells receivers what to do with mail from a server not listed anywhere else in the record. ~all is the soft-fail qualifier: it asks receivers to mark unauthorized mail as suspicious, but does not instruct them to reject it outright.
Why it matters
Soft fail is a reasonable place to sit while you confirm you have listed every legitimate sending source — it lets you catch mistakes in a new SPF record without hard-rejecting your own mail if you missed one. But it is not the end state. Most receivers still deliver soft-failed mail, typically to the spam folder rather than blocking it, so a domain that stays at ~all indefinitely gets weaker protection against spoofing than it appears to have.
What Nivaronix checks
Nivaronix performs a live TXT lookup, isolates the single record beginning with v=spf1, and reads its final mechanism. This finding fires when exactly one SPF record exists and it ends in ~all.
Example evidence (illustrative — not live scan data)
TXT example.com: v=spf1 include:_spf.google.com ~all
How to fix it
- Confirm every legitimate sending service for this domain is already listed in the record.
- Watch mail flow for a period to make sure nothing legitimate is being marked as suspicious.
- Once confident, edit the TXT record at your DNS host and replace the trailing
~allwith-all.
How to verify the fix
Re-run the SPF & DMARC checker and confirm it now reports the record ending in -all.