Changing ~all to -all strengthens the statement a domain makes about an unmatched sending IP. It does not turn the domain owner into the recipient's mail filter. A useful decision starts with two questions: which legitimate connections remain unmatched, and what happens to those messages at the receiving systems that matter?
Read the result before judging delivery
SPF checks whether the connecting host may use the evaluated SMTP identity. A matching positive mechanism produces pass. If evaluation reaches ~all, it produces softfail, a qualified statement that the host is probably unauthorised. Reaching -all produces fail, a definite statement that it is unauthorised. “Hardfail” is common shorthand; the protocol result is named fail.
RFC 7208 §8.4 and RFC 7208 §8.5 separate that statement from handling. Fail disposition is receiver-local policy. For softfail, the RFC recommends against rejection based solely on that result, while allowing closer scrutiny. Neither qualifier promises an inbox, spam-folder placement or a universal SMTP rejection. A receiver may reject for unrelated reasons even when SPF passes.
Mechanisms are evaluated in order under RFC 7208 §4.6.2. Changing the last qualifier does nothing for a message that already matches an earlier positive mechanism. An overly broad ip4 range or service include remains overly broad after adding -all.
Separate missing senders from indirect delivery
Build a list of actual SMTP sending services, their envelope domains and representative receiver observations. An employee mailbox, billing application and marketing platform can use different envelope domains even when their visible From address looks identical. Diagnose the domain shown in the trusted receiver's SPF result, not the domain that merely appears on screen.
Forwarding changes the connecting IP. If the original envelope identity is retained, the final receiver can see a legitimate message from a host the original domain did not authorise. Adding every forwarder to the original sender's SPF policy is not a scalable repair and may authorise infrastructure outside your control. Investigate the forwarding design and the message's other authentication evidence. Do not classify every forwarded failure as a forgotten outbound service. RFC 7208 §10.3 discusses this architectural difficulty.
Work through a controlled example
Illustrative example, using documentation-only addresses: v=spf1 ip4:192.0.2.10 ~all authorises a direct connection from 192.0.2.10. A connection from 198.51.100.20 reaches softfail. Replacing ~all with -all changes the latter result to fail but leaves the former as pass.
Now suppose 198.51.100.20 forwards mail originally sent by 192.0.2.10 and preserves its envelope identity. The SPF result at the final receiver follows the forwarding connection, not the first hop. This is an expected test scenario, not evidence that the original service stopped sending correctly.
Make a reversible policy decision
Before changing the qualifier, preserve the existing TXT record and TTL, verify sender ownership, and agree what evidence would trigger a restoration. Test critical direct paths and known indirect paths separately. Record the source IP, evaluated domain, SPF result and final delivery outcome for each test. Include an unmatched test source under your control so the change's actual effect is visible.
After publication, check authoritative DNS and relevant recursive answers, allowing for cached data. Investigate failures rather than simply reverting every time a message is filtered. A missing authorised source needs an inventory correction; a forwarding issue needs a route-aware decision; an unrelated reputation rejection will not be fixed by changing the final qualifier.
Close with a defensible record
Keep the reason for the chosen qualifier beside the current sender inventory. Review it when services or delivery routes change. A restrictive final mechanism is useful only when the preceding authorisations describe the domain's real sending boundaries. The decision is complete when the owner can explain both the direct-mail coverage and the indirect-mail trade-offs.
Use the evidence for a decision
In the synthetic record, 192.0.2.10 remains pass after the qualifier change; 198.51.100.20 moves from softfail to fail only when the final mechanism is reached. Record the receiver handling separately. If the second IP is a forwarder preserving the original envelope, investigate the indirect route before treating it as a missing authorized sender. No live delivery or qualifier change was executed.