SPF ends with an all-mechanism

The all mechanism is the catch-all at the end of an SPF record: it decides what a receiver should conclude about a sender that matched none of the preceding terms. -all says the list is complete and anything else is forged. ~all (softfail) says it is probably forged but asks the receiver not to reject on that basis alone. ?all is explicitly no opinion, and +all asserts that any host on the internet may send as you, which is never what anyone means.

A record with no all at all defaults to neutral — the same as ?all. That is the case worth noticing, because it looks like a configured SPF record and provides none of the protection people assume it does.

The qualifier matters less on its own than it does under DMARC. DMARC treats softfail and hardfail identically when deciding whether SPF authenticated the message, so ~all and -all produce the same DMARC outcome. The difference is what receivers do *outside* DMARC, where a hardfail is a much stronger signal.

-all is the right end state, and ~all is the right place to stand while you are still finding out who sends as you. Publishing -all before you know is how a payroll system or a monitoring alerter that nobody remembered stops being delivered.

The way through is DMARC aggregate reports. Publish ~all with a DMARC record carrying rua=, read a few weeks of reports to find every legitimate sender, add them, and only then tighten to -all.

If you find +all, remove it now. It is almost always left over from debugging, and while it is published, SPF is affirmatively vouching for every host that tries to send as your domain.