SPF softfail means the server that sent an email is not on the list in the sender domain's SPF record, and the record ends with ~all, which tells the receiver "probably not authorized, but don't reject it." The message is usually delivered, often with extra suspicion. For a small business on Google Workspace, the record itself is fine, because Google recommends ending it with ~all. A softfail in a test email almost always points to a different problem: something else is sending mail for your domain that you have not listed.
Softfail, hardfail and neutral
An SPF record is a line of text in your domain's DNS that lists the servers allowed to send mail as you. It ends with an instruction for everything not on the list. The symbol in front of "all" is the whole difference:
| Ending | Name | What it tells the receiver |
|---|---|---|
| -all | Hardfail | Anything not listed is not authorized. Reject or treat harshly. |
| ~all | Softfail | Anything not listed is probably not authorized. Accept it, but be suspicious. |
| ?all | Neutral | No opinion about anything not listed. |
| +all | Pass for all | Anyone may send as this domain. Never use it. |
So softfail is the middle setting. Google's own setup page for Workspace gives this record, and says Google recommends using ~all:
v=spf1 include:_spf.google.com ~all
Where you see it in a message header
Send a test email from your business address to a Gmail account you control. Open it, click the three dots, choose Show original, and read the box at the top. You will see a line for SPF with PASS, SOFTFAIL, FAIL or NEUTRAL, along with the sending IP address. Further down, in the raw header, the same result appears in a form like this one:
Received-SPF: softfail (google.com: domain of transitioning brenda@omahaplans.example does not designate 203.0.113.44 as permitted sender)
The IP address at the end is the useful part. It is the server that actually sent the mail, and it is not on your list.
Why it appears for Gmail senders
If you send from the Gmail or Workspace screen using your own address, Google's servers send the message, they are on your list, and the result is a pass. Softfail shows up when something else sends:
- A website contact form, newsletter tool, invoicing system or CRM sends mail "from" your address through its own servers.
- You added another address to Gmail's "Send mail as" through someone else's mail server. Sending from an alias in Gmail explains which setups stay on Google's servers.
- The message was forwarded by another mailbox. A forwarder sends it from its own IP address, so SPF often softfails even though the original was fine. This is normal and not your fault.
- The record is incomplete or has a typo, so a server that should be listed is not.
Brenda runs a property inspection firm in Omaha. Her test email to herself showed SOFTFAIL for 203.0.113.44. She looked the address up and found it belonged to the company that hosts her website, which sent her booking confirmations "from" her domain. Her record listed only Google. She added the host's include to the record: v=spf1 include:_spf.google.com include:spf.webhost.example ~all. The next test showed PASS.
When it matters and when it does not
It matters when the softfail is on mail you care about: your cold outreach, your quotes, your replies to customers. A softfail there counts against you with a filter, and it is easy to fix. It matters less when the failing source is a forwarded message you did not control, or a tool you do not use for outreach.
SPF is also only one of three checks. If your DKIM signature passes and matches your domain, DMARC can still pass even when SPF softfails, so a single softfail is not a delivery failure. All three are covered in SPF, DKIM and DMARC for cold email. And when a domain has DMARC enforcement turned on, softfail and hardfail protect against spoofing about equally, since DMARC makes the final decision.
~all or -all for a small sender
Use ~all unless you have a specific reason not to. Google recommends it, it is forgiving when a legitimate tool is missing from your record, and the extra protection from -all is small once DMARC is in place. Moving to -all makes sense only when you know every service that sends mail as your domain, you have watched DMARC reports for a few weeks without surprises, and you accept that a missing source will now be rejected by servers that honor the rule.
Moving to a stricter record safely
- List every service that sends mail as your domain: Google, your website forms, billing, newsletters, your CRM.
- Send a test from each one to a Gmail address and check that SPF passes, adding each service's include to your record if not.
- Keep an eye on the count of DNS lookups. SPF allows only 10, and each include uses one or more. Go over and the whole record fails.
- Set a DMARC record with p=none and a reporting address, and read the reports for two to four weeks.
- Change ~all to -all, retest every sender, and write down the old record so you can put it back.
The aim is not a stricter record for its own sake. It is to make sure the mail you send gets treated as yours. Related reading: startup cold email deliverability basics for the full picture, can you send cold email from your main domain for the domain question, cold email bounce rate for how rejected mail shows up, and Google Postmaster Tools for the authentication view Google gives bulk senders.
Other SPF words you may see
SPF: the list of servers allowed to send for a domain. DKIM: a signature added to the message that proves it was not changed. DMARC: the policy that says what to do when SPF and DKIM do not line up. Alignment: whether the domain checked matches the domain in your From address. Permerror: an SPF record so broken, for example over 10 lookups, that it cannot be evaluated. Envelope sender: the hidden return address SPF actually checks.
Rocketship sends from your own Gmail, so mail goes out through Google's servers on your domain. It finds the buyers by name, follows up, and books the meeting on its own. Plans that get you customers start at $24.99 a month (Launch), and every monthly plan starts with a 7-day free trial, card required. See the AI workers.