Post Deleted by Community
    Post Locked by Community
    Post Migrated Away to serverfault.com by Stephen Ostermiller
    Post Closed as "off-topic" by Stephen Ostermiller
3 Use term "SoftFail" per spec
source | link

Question

What are the advantages and disadvantages of using failFail vs. a soft failSoftFail in my SPF record?

What I found on the topic

Back in 2007, knowledgeable-seeming folks seem to have said soft failSoftFail was just for testing and encouraged changing it to reject once you have everything setup properly (here and here)

This forum post calls soft failSoftFail "wrongly configured", but then says that Google uses it. I trust Google for best practices more than a random forum poster! I checked and indeed, Gmail uses ~all (a soft-failSoftFail) in their SPF record.

On the sender end of things, email deliverability experts seem to encourage using soft failSoftFail:

failFail "is more aggressive [than soft fail]SoftFail] and is known to create more issues than it solves (we don’t recommend it)."

Postmark SPF Guide

That's rather vague.

"I generally recommend publishing ~all records for my clients. There’s not a huge benefit to publishing -all and sometimes mail gets forwarded around. The one time I recommend a -all record is when a domain is getting forged into spam. Domain forgery can cause a lot of bounces. The amount of bounces can be bad enough to take down a mail server, particularly those with a small userbase. Many ISPs will check SPF before sending back a bounce and so a -all record can decrease the amount of blowback the domain owner has to deal with."

—Email deliverability consultants Word to the Wise

Yet how will a webmaster know if there is a substantial amount of domain forgery going on? Isn't a best practice to prepare for the worst and anticipate forgery in advance?

On the receiving end, Terry Zink, who works in enterprise spam filtering, offers a strong case for hard failFail to prevent phishing emails from going through, and says most people use soft failSoftFail because organizations are more afraid of emails being lost than about forged emails. What is the likelihood that a forged phishing email which SPF soft-failsSoftFails actually gets to someone's inbox?

Question

What are the advantages and disadvantages of using fail vs. a soft fail in my SPF record?

What I found on the topic

Back in 2007, knowledgeable-seeming folks seem to have said soft fail was just for testing and encouraged changing it to reject once you have everything setup properly (here and here)

This forum post calls soft fail "wrongly configured", but then says that Google uses it. I trust Google for best practices more than a random forum poster! I checked and indeed, Gmail uses ~all (a soft-fail) in their SPF record.

On the sender end of things, email deliverability experts seem to encourage using soft fail:

fail "is more aggressive [than soft fail] and is known to create more issues than it solves (we don’t recommend it)."

Postmark SPF Guide

That's rather vague.

"I generally recommend publishing ~all records for my clients. There’s not a huge benefit to publishing -all and sometimes mail gets forwarded around. The one time I recommend a -all record is when a domain is getting forged into spam. Domain forgery can cause a lot of bounces. The amount of bounces can be bad enough to take down a mail server, particularly those with a small userbase. Many ISPs will check SPF before sending back a bounce and so a -all record can decrease the amount of blowback the domain owner has to deal with."

—Email deliverability consultants Word to the Wise

Yet how will a webmaster know if there is a substantial amount of domain forgery going on? Isn't a best practice to prepare for the worst and anticipate forgery in advance?

On the receiving end, Terry Zink, who works in enterprise spam filtering, offers a strong case for hard fail to prevent phishing emails from going through, and says most people use soft fail because organizations are more afraid of emails being lost than about forged emails. What is the likelihood that a forged phishing email which SPF soft-fails actually gets to someone's inbox?

Question

What are the advantages and disadvantages of using Fail vs. a SoftFail in my SPF record?

What I found on the topic

Back in 2007, knowledgeable-seeming folks seem to have said SoftFail was just for testing and encouraged changing it to reject once you have everything setup properly (here and here)

This forum post calls SoftFail "wrongly configured", but then says that Google uses it. I trust Google for best practices more than a random forum poster! I checked and indeed, Gmail uses ~all (a SoftFail) in their SPF record.

On the sender end of things, email deliverability experts seem to encourage using SoftFail:

Fail "is more aggressive [than SoftFail] and is known to create more issues than it solves (we don’t recommend it)."

Postmark SPF Guide

That's rather vague.

"I generally recommend publishing ~all records for my clients. There’s not a huge benefit to publishing -all and sometimes mail gets forwarded around. The one time I recommend a -all record is when a domain is getting forged into spam. Domain forgery can cause a lot of bounces. The amount of bounces can be bad enough to take down a mail server, particularly those with a small userbase. Many ISPs will check SPF before sending back a bounce and so a -all record can decrease the amount of blowback the domain owner has to deal with."

—Email deliverability consultants Word to the Wise

Yet how will a webmaster know if there is a substantial amount of domain forgery going on? Isn't a best practice to prepare for the worst and anticipate forgery in advance?

On the receiving end, Terry Zink, who works in enterprise spam filtering, offers a strong case for hard Fail to prevent phishing emails from going through, and says most people use SoftFail because organizations are more afraid of emails being lost than about forged emails. What is the likelihood that a forged phishing email which SPF SoftFails actually gets to someone's inbox?

2 italicize for readability clarifying sender/receiver dichotomy
source | link

Question

What are the advantages and disadvantages of using fail vs. a soft fail in my SPF record?

What I found on the topic

Back in 2007, knowledgeable-seeming folks seem to have said soft fail was just for testing and encouraged changing it to reject once you have everything setup properly (here and here)

This forum post calls soft fail "wrongly configured", but then says that Google uses it. I trust Google for best practices more than a random forum poster! I checked and indeed, Gmail uses ~all (a soft-fail) in their SPF record.

On the sender endsender end of things, email deliverability experts seem to encourage using soft fail:

fail "is more aggressive [than soft fail] and is known to create more issues than it solves (we don’t recommend it)."

-Postmark SPF Guide

That's rather vague.

"I generally recommend publishing ~all records for my clients. There’s not a huge benefit to publishing -all and sometimes mail gets forwarded around. The one time I recommend a -all record is when a domain is getting forged into spam. Domain forgery can cause a lot of bounces. The amount of bounces can be bad enough to take down a mail server, particularly those with a small userbase. Many ISPs will check SPF before sending back a bounce and so a -all record can decrease the amount of blowback the domain owner has to deal with."

—Email deliverability consultants Word to the Wise

Yet how will a webmaster know if there is a substantial amount of domain forgery going on? Isn't a best practice to prepare for the worst and anticipate forgery in advance?

On the receiving endreceiving end, Terry Zink, who works in enterprise spam filtering, offers a strong case for hard fail to prevent phishing emails from going through, and says most people use soft fail because organizations are more afraid of emails being lost than about forged emails. What is the likelihood that a forged phishing email which SPF soft-fails actually gets to someone's inbox?

Question

What are the advantages and disadvantages of using fail vs. a soft fail in my SPF record?

What I found on the topic

Back in 2007, knowledgeable-seeming folks seem to have said soft fail was just for testing and encouraged changing it to reject once you have everything setup properly (here and here)

This forum post calls soft fail "wrongly configured", but then says that Google uses it. I trust Google for best practices more than a random forum poster! I checked and indeed, Gmail uses ~all (a soft-fail) in their SPF record.

On the sender end of things, email deliverability experts seem to encourage using soft fail:

fail "is more aggressive [than soft fail] and is known to create more issues than it solves (we don’t recommend it)."

-Postmark SPF Guide

That's rather vague.

"I generally recommend publishing ~all records for my clients. There’s not a huge benefit to publishing -all and sometimes mail gets forwarded around. The one time I recommend a -all record is when a domain is getting forged into spam. Domain forgery can cause a lot of bounces. The amount of bounces can be bad enough to take down a mail server, particularly those with a small userbase. Many ISPs will check SPF before sending back a bounce and so a -all record can decrease the amount of blowback the domain owner has to deal with."

Yet how will a webmaster know if there is a substantial amount of domain forgery going on? Isn't a best practice to prepare for the worst and anticipate forgery in advance?

On the receiving end, Terry Zink, who works in enterprise spam filtering, offers a strong case for hard fail to prevent phishing emails from going through, and says most people use soft fail because organizations are more afraid of emails being lost than about forged emails. What is the likelihood that a forged phishing email which SPF soft-fails actually gets to someone's inbox?

Question

What are the advantages and disadvantages of using fail vs. a soft fail in my SPF record?

What I found on the topic

Back in 2007, knowledgeable-seeming folks seem to have said soft fail was just for testing and encouraged changing it to reject once you have everything setup properly (here and here)

This forum post calls soft fail "wrongly configured", but then says that Google uses it. I trust Google for best practices more than a random forum poster! I checked and indeed, Gmail uses ~all (a soft-fail) in their SPF record.

On the sender end of things, email deliverability experts seem to encourage using soft fail:

fail "is more aggressive [than soft fail] and is known to create more issues than it solves (we don’t recommend it)."

Postmark SPF Guide

That's rather vague.

"I generally recommend publishing ~all records for my clients. There’s not a huge benefit to publishing -all and sometimes mail gets forwarded around. The one time I recommend a -all record is when a domain is getting forged into spam. Domain forgery can cause a lot of bounces. The amount of bounces can be bad enough to take down a mail server, particularly those with a small userbase. Many ISPs will check SPF before sending back a bounce and so a -all record can decrease the amount of blowback the domain owner has to deal with."

—Email deliverability consultants Word to the Wise

Yet how will a webmaster know if there is a substantial amount of domain forgery going on? Isn't a best practice to prepare for the worst and anticipate forgery in advance?

On the receiving end, Terry Zink, who works in enterprise spam filtering, offers a strong case for hard fail to prevent phishing emails from going through, and says most people use soft fail because organizations are more afraid of emails being lost than about forged emails. What is the likelihood that a forged phishing email which SPF soft-fails actually gets to someone's inbox?

1
source | link

SPF fail vs. soft-fail pros and cons

Question

What are the advantages and disadvantages of using fail vs. a soft fail in my SPF record?

What I found on the topic

Back in 2007, knowledgeable-seeming folks seem to have said soft fail was just for testing and encouraged changing it to reject once you have everything setup properly (here and here)

This forum post calls soft fail "wrongly configured", but then says that Google uses it. I trust Google for best practices more than a random forum poster! I checked and indeed, Gmail uses ~all (a soft-fail) in their SPF record.

On the sender end of things, email deliverability experts seem to encourage using soft fail:

fail "is more aggressive [than soft fail] and is known to create more issues than it solves (we don’t recommend it)."

-Postmark SPF Guide

That's rather vague.

"I generally recommend publishing ~all records for my clients. There’s not a huge benefit to publishing -all and sometimes mail gets forwarded around. The one time I recommend a -all record is when a domain is getting forged into spam. Domain forgery can cause a lot of bounces. The amount of bounces can be bad enough to take down a mail server, particularly those with a small userbase. Many ISPs will check SPF before sending back a bounce and so a -all record can decrease the amount of blowback the domain owner has to deal with."

Yet how will a webmaster know if there is a substantial amount of domain forgery going on? Isn't a best practice to prepare for the worst and anticipate forgery in advance?

On the receiving end, Terry Zink, who works in enterprise spam filtering, offers a strong case for hard fail to prevent phishing emails from going through, and says most people use soft fail because organizations are more afraid of emails being lost than about forged emails. What is the likelihood that a forged phishing email which SPF soft-fails actually gets to someone's inbox?