Let's say we have an SPF record that looks like this:

If example.com's spf record exists but has a softfail for all (I.E. ~all at the end of their spf record), what will happen if the sender IP doesn't match anything in the record? Will it fail with -all in my spf record? Or will it accept but mark because example.com has a softfail?

SPF records are evaluated strictly left-to-right. The "include" mechanism literally includes the result of the evaluation of the SPF record from the specified domain, so if that domain has an SPF record but there's no match, the next mechanism is evaluated.

If example.com has a softfail (~all) at the end of its record and you have a fail (-all) in your record, it will work like you had specified both, with the softfail first ("~all -all"). In that scenario, due to the combination of strict left-to-right evaluation and the fact that "all" is always a match, only the softfail would ever be processed.

Be aware that an include mechanism referencing a domain without an SPF record is a "permanent error", which some mail servers treat as a "fail".

BTW, your example exactly matches the one used in the "record syntax" section at the openspf.com web site, which is as close to an authoritative source as you can get.

2 members found this post helpful.

Thank you very much for your reply. the example.com in this scenario is Google. I'm kind of surprised that they would have a soft fail in their SPF records.