Why a Domain With SPF Softfail but No DMARC Attracts Phishers
A domain that publishes an SPF record ending in ~all signals that someone has thought about email authentication, then stopped halfway. The softfail qualifier tells receiving servers that unauthorised senders should be marked but not necessarily rejected. Without a DMARC policy on top, the message is essentially "I have a suggestion, take it or leave it." Phishers have learned to live with that suggestion.
Australia has become a fertile testing ground for these half-protected domains. The Australian Cyber Security Centre recorded more than 94,000 cybercrime reports in the most recent financial year, with phishing near the top. Many lures arrive from lookalike domains whose owners copy the SPF template of the brand they impersonate, add a softfail, and ship the message before any reject policy kicks in.
A domain that authenticates the envelope sender through SPF but lacks DMARC gives mailbox providers no clear instruction on what to do when alignment fails, and gives security teams no aggregated visibility into the misuse. The result is a permissive posture that costs almost nothing to exploit.
How SPF softfail behaves without a DMARC policy
SPF lists the IP addresses permitted to send mail for a domain in a DNS TXT record, with a qualifier at the end that determines the response when a sender falls outside that list. A hardfail, written as -all, instructs receivers to reject outright. A softfail, written as ~all, produces a neutral result that many systems log but still deliver.
DMARC ties the SPF result to the visible From header and adds a policy telling receivers to do nothing, quarantine, or reject when alignment breaks. A domain with SPF softfail and no DMARC has told the world how to send its mail, but not what to do when that advice is ignored. When a phisher sends from a server not on the list, providers in Sydney, Melbourne and Brisbane drop a -all message at the gateway, while a ~all message often lands in junk or, too often, the inbox.
The visibility gap phishers rely on
Phishers do not need a perfect forgery, just a plausible one that reaches a corporate inbox in Parramatta, a small business in Hobart, or a retiree in Cairns. A domain publishing SPF with ~all gives them the first part of that bargain. The receiving server performs the check, sees a softfail, and continues processing.
Without DMARC, there is no reporting channel back to the domain owner. Administrators in Adelaide or Perth remain unaware that their brand is being spoofed from servers abroad until a customer forwards a screenshot. A throwaway domain costs a few dollars, copying an SPF template from a public DNS lookup takes seconds, and sending a wave of fake Australia Post or ATO notifications takes minutes, with the softfail doing almost nothing to stop it.
Australian regulations that raise the stakes
Australia's Notifiable Data Breaches scheme, run by the Office of the Australian Information Commissioner, requires organisations to report eligible breaches likely to result in serious harm. A successful phishing campaign that captures staff credentials can trigger that obligation, along with the associated reputational and financial cost.
The Australian Signals Directorate's Essential Eight maturity model places DMARC at the heart of its email security recommendations, and the Australian Prudential Regulation Authority's CPS 234 standard pushes banks and insurers in the same direction. Impersonation of brands like Westpac, ANZ, or Telstra from a domain that lacks DMARC reporting makes incident response harder, because the legitimate owner cannot quickly enumerate abuse sources.
| Configuration | SPF result | DMARC policy | Receiver behaviour | Phisher risk |
|---|---|---|---|---|
| SPF ~all, no DMARC | Softfail | None | Delivered, logged | High |
| SPF -all, no DMARC | Hardfail | None | Most reject | Low |
| SPF ~all, DMARC p=none | Softfail | Monitor | Delivered, reports sent | Medium, observable |
| SPF -all, DMARC p=quarantine | Hardfail | Quarantine | Spam or rejected | Very low |
| SPF -all, DMARC p=reject | Hardfail | Reject | Rejected at gateway | Negligible |
Brand impersonation patterns seen across Australia
A few patterns repeat in Australian inboxes. Tax time brings waves of fake ATO and myGov messages promising refunds or demanding overdue payments. Disaster season produces fraudulent charity appeals after bushfires in New South Wales or floods in Victoria. Energy bill scams impersonating AGL or Origin arrive year-round.
The spoofed domain often shows a working SPF record with a softfail, and the sender has authenticated the envelope to pass gateway checks. Without DMARC, the brand owner cannot request takedowns based on a published policy. Organisations beginning to map their own exposure can work through a getting started guide to run their first checks.
Businesses in retail corridors from Brisbane's Queen Street to Melbourne's Collins Street have watched customer trust erode after a single convincing lure, many traced back to a softfail-only domain that looked legitimate on paper.
Reading DMARC reports to expose the softfail gap
The first signal that a softfail-only domain is being abused shows up in DMARC aggregate reports, also called RUA reports. These XML files list every IP that attempted to send mail claiming to be from the domain, with the SPF and DKIM result. A spike in unfamiliar senders passing SPF but failing alignment is a classic warning.
A longer look at the value of those records sits in this DMARC ecosystem analysis walkthrough, which maps how thousands of reports over weeks and months reveal the full surface area of a domain's email traffic and where the softfail gap is widest.
Closing the authentication gap
The fix requires DNS changes and a few weeks of monitoring. Move the SPF record from ~all to -all once all legitimate sending sources are listed, publish a DKIM key for every sending platform, and add a DMARC record starting with a none policy before tightening to quarantine and finally reject.
Domain owners uncertain about their current posture can check the frequently asked questions section for guidance on interpreting results and common configuration mistakes. The same checks that catch a softfail-only domain also catch phishers who register typosquats of well-known Australian brands, and once a reject policy is in place and honoured by major providers, the softfail loophole finally closes.