spf=softfail

spf=softfail means the sending server's IP address was not on the SPF list for the bounce-address domain, and the domain's record ends with ~all rather than -all. The owner is saying "this probably isn't us, but don't throw it away on our word alone." You will see it far more often than a hard fail, because many providers' setup guides suggest ~all.

What the RFC says

RFC 7208 §2.6.5 describes softfail as a weak statement that the host is probably not authorized, from a domain that chose not to publish anything stronger. The ~ qualifier produces it (§4.6.2). §8.5 places it between fail and neutral: receivers should not reject a message on softfail alone, but may look at it more closely. The RFC gives highlighting the status in the mail client or greylisting the sender as examples.

Authentication-Results: mx.example.org;
       spf=softfail (domain of transitioning news@example.com does not
       designate 192.0.2.77 as permitted sender) smtp.mailfrom=news@example.com;
       dkim=none;
       dmarc=fail (p=quarantine) header.from=example.com

The word "transitioning" in some receivers' comments is a hint at the original intent of ~all: a domain still moving to a complete list of senders.

What usually causes it

• Forwarding, exactly as with a hard fail: the forwarder's IP is not in the original domain's record.
• A service missing from the record. The domain owner set up a newsletter tool, payroll system or ticketing service and never updated SPF. The ~all keeps this mistake from bouncing mail, which is why people choose it.
• Spoofing of a domain whose owner uses ~all. Softfail gives the attacker nothing, but it doesn't stop them either.

If you received this message

On its own, softfail is a mild warning. What decides things is DMARC: if the domain publishes a DMARC policy, receivers act on the DMARC result, not on the ~ versus - difference, though the final call is always the receiver's (RFC 9989 §5.4). In the snippet above nothing passed in alignment, so DMARC failed and the quarantine policy applies. That combination, with no forwarding in the Received chain, deserves suspicion. If DKIM passed for the From domain, you can ignore the softfail.

If you own the domain

Treat softfail on your own mail as a to-do item. Find the IP, identify the service, and add it to the record. Once DMARC aggregate reports show every legitimate source passing, you can choose -all or keep ~all. With a DMARC policy of quarantine or reject in place, receivers base their decision on DMARC either way, so the alignment work matters more than the qualifier. The DMARC guide covers the reports.