WHM/cPanel soft fail vs hard fail
 ~ Spf Soft fail - Spf Hard Fail
What is the difference between an SPF "hard fail" and "soft fail"?
How to setup SPF record on entire server for all domains?
how do I add this SPF record for all accounts, existing and new
SPF RECORDS (VPS & DEDICATED)




~all specifies how hosts should regard servers that are not on the list.
There are a few modifies you can use here:


  • - all "Hard Fail" means reject all mail that isn't on the allowed list.
  • ~ all "Soft fail" means accept mail not on the allowed list, but treat it with more scrutiny.
  • ? all "Neutral" means accept all mail; there isn't a policy for servers not on the list.


~ Soft fail - hard fail SPF
What is the difference between an SPF "hard fail" and "soft fail"?
SPF Email Deliver
~ Soft fail - hard fail

~ Soft fail

SPF .

By default, the system recommends the ~all entry. This entry instructs servers to accept mail from unmatched hosts, but warn that unauthorized hosts might have sent the messages.

- hard fail
SMTP

If you enable the Exclude All Other Hosts ("-all" Entry) setting, the SPF feature causes hosts that you do not define to fail.

A hard fail will cause the recipient mail server to reject any messages sent from any location not specified in the SPF record. A soft fail permits the recipient mail server to accept messages sent from any location not specified in the SPF record. Some email services will mark messages that soft fail the SPF check as suspicious or spam. SPF records should only be configured with soft fail while changes to the SPF record are being tested.

SPF examples

A hard fail is designed by - all (hyphen) at the end of the SPF record.

:
v=spf1 +a +mx +ip4 203.0.113.2 -all
A soft fail is designed by ~ all (tilde) at the end of the SPF record.

:
v=spf1 +a +mx +ip4 203.0.113.2 ~all
SPF - Hard Fail

SPF Hard Fail Soft Fail

Verifying if the SPF record is working

The quickest way to test if major mail providers are accepting your new SPF record is by sending a test email and reviewing the email headers.

Cpanel Whm Email Deliverability





SPF


The mail provider used for this test is Gmail.
You can find instructions on viewing email headers for a Gmail account here:
Google's View your email's full headers
Once obtaining a copy of the email headers for the test email, you can find the "Authentication-Results" by scrolling down through the headers. This section will house the results of the SPF Record currently in use by the domain. You'll want this value to be a "pass" and not "fail":




Should the value return "fail", then you may want to revisit the record and adjust the value once more. cPanel's Email Deliverability interface offers a recommended SPF record if you're unsure of how to compose this record.


SFP DKIM PASS

SFP DKIM WHM CPANEL PASS

:
https://support.cpanel.net/hc/en-us/...-and-soft-fail
https://support.cpanel.net/hc/en-us/...ds-are-working
https://docs.cpanel.net/cpanel/email...257.1696885008
https://support.cpanel.net/hc/en-us/...or-all-domains
https://copyprogramming.com/howto/ho...-record-in-whm