-all (fail): hosts not listed are not authorised to send for the domain.~all (softfail): hosts not listed are probably not authorised, but the domain owner is not asking receivers to treat it as a definite failure.?all (neutral): no statement about unlisted hosts. It gives no protection.+all (pass): every host on the internet is authorised. Never use it.If you are still finding every service that sends as your domain, ~all is the cautious choice, because a forgotten sender is not treated as a hard failure. Once your list is complete and checked, -all states your policy more strongly.
DMARC passes when SPF or DKIM passes and aligns with the From domain. A message can fail SPF and still pass DMARC if an aligned DKIM signature passes. So an enforced DMARC policy, not the SPF ending alone, usually decides what happens to spoofed mail.
An SPF record can also fail from too many DNS lookups or from a second SPF record. See the lookup counter and merging records for several providers.
The free checker reads your live DNS and shows what is missing. The $29 Email Fix Pack writes the fix for your email provider and DNS host, with a rollback plan.