Does Google simply allow all Internet hosts in its SPF records?

gistfile1.txt

➜  ~  dig @8.8.8.8 _spf.google.com txt

; <<>> DiG 9.8.3-P1 <<>> @8.8.8.8 _spf.google.com txt
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5516
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;_spf.google.com.		IN	TXT

;; ANSWER SECTION:
_spf.google.com.	213	IN	TXT	"v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all"

;; Query time: 144 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Dec  4 17:37:29 2013
;; MSG SIZE  rcvd: 149

➜  ~  dig @8.8.8.8 _netblocks.google.com txt

; <<>> DiG 9.8.3-P1 <<>> @8.8.8.8 _netblocks.google.com txt
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10100
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;_netblocks.google.com.		IN	TXT

;; ANSWER SECTION:
_netblocks.google.com.	3600	IN	TXT	"v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:173.194.0.0/16 ~all"

;; Query time: 148 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Dec  4 17:37:34 2013
;; MSG SIZE  rcvd: 254

➜  ~  dig @8.8.8.8 _netblocks2.google.com txt

; <<>> DiG 9.8.3-P1 <<>> @8.8.8.8 _netblocks2.google.com txt
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9464
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;_netblocks2.google.com.		IN	TXT

;; ANSWER SECTION:
_netblocks2.google.com.	3600	IN	TXT	"v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all"

;; Query time: 152 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Dec  4 17:37:38 2013
;; MSG SIZE  rcvd: 207

➜  ~  dig @8.8.8.8 _netblocks3.google.com txt

; <<>> DiG 9.8.3-P1 <<>> @8.8.8.8 _netblocks3.google.com txt
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7626
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;_netblocks3.google.com.		IN	TXT

;; ANSWER SECTION:
_netblocks3.google.com.	3514	IN	TXT	"v=spf1 ~all"

;; Query time: 143 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Dec  4 17:37:50 2013
;; MSG SIZE  rcvd: 64

➜  ~

No. See http://en.wikipedia.org/wiki/Sender_Policy_Framework.

~ (tilde) for SOFTFAIL, a debugging aid between NEUTRAL and FAIL. Typically, messages that return a SOFTFAIL are accepted but tagged.

Ok, so all hosts not in the first two netblocks will SOFTFAIL rather than FAIL.

Thanks for the explanation.