Question
What is the difference between an SPF "hard fail" and "soft fail"?
Answer
A hard fail will cause the recipient mail server to reject any messages sent from any location not specified in the SPF record. A soft fail permits the recipient mail server to accept messages sent from any location not specified in the SPF record. Some email services will mark messages that soft fail the SPF check as suspicious or spam. SPF records should only be configured with soft fail while changes to the SPF record are being tested.
SPF examples
A hard fail is designed by -all (hyphen) at the end of the SPF record.
v=spf1 +a +mx +ip4 203.0.113.2 -all
A soft fail is designed by ~all (tilde) at the end of the SPF record.
v=spf1 +a +mx +ip4 203.0.113.2 ~all