---
title: SPF Hard Fail risks
slug: asm/spf-hard-fail-risks
docTags: 
createdAt: 2024-04-11T15:19:44.418Z
---

**Risk: **SPF is set to hard fail all other sources (-all). 

Whilst this is the strictest choice, it can lead to email deliverability issues. Soft fail (\~all) provides a better compromise between security and reliability for most organisations. For more information, see section 5 of [this document](https://www.m3aawg.org/sites/default/files/m3aawg-email-authentication-recommended-best-practices-09-2020.pdf) from the Messaging, Malware and Mobile Anti-Abuse Working Group.

**Remediation: **Update the SPF record for the domain to soft fail mail that doesn't pass an SPF check, i.e. update to \~all