SPF Conditional Mode

SPF ~all vs -all: Conditional Mode

TL;DR: once DMARC is actually enforcing (quarantine/reject), a hard SPF fail (-all) adds risk without adding protection — DMARC already covers it.

The two modes

Selectable per organization:

Mode	Behavior
Strict	Always recommends -all (hardfail) — the traditional, unconditional advice
Conditional	Recommends -all until the domain's DMARC policy (its own, or inherited from its parent) reaches quarantine/reject — at that point ~all is recommended instead

Why

SPF alone evaluates before DKIM/DMARC even run — a -all hardfail can bounce a legitimately relayed or forwarded message at the SMTP level before DMARC gets a chance to align it via DKIM instead. Once DMARC is already enforcing, that risk is pure downside: DMARC is the actual enforcement mechanism at that point, and ~all (softfail) stops adding a second, blunter failure path on top of it.

Conditional mode resolves the effective policy the same way the DMARC checker does — walking up to the parent for a subdomain with no record of its own — so a subdomain correctly gets credited for ~all once its parent is enforcing, rather than being held to the strict default just because it has no DMARC record of its own to check.

Worked example

example.com is in Conditional mode. Its DMARC policy starts at p=none (monitoring) — SPF check recommends -all. Three months later, pass rates are healthy and the policy moves to p=reject. The SPF recommendation automatically flips to ~all — no separate action needed, and no ~all-vs--all decision to revisit by hand.

See also

• DMARC Subdomain Policy Inheritance
• Domain Rating: How the 0–100 Score Is Calculated

---

← Core Concepts · Home