SPF records use a specific syntax to define which servers can send email for your domain. Understanding this syntax helps you configure SPF correctly and troubleshoot issues.
Basic SPF Structure
SPF records start with "v=spf1" to indicate the version. Mechanisms follow, each specifying allowed senders. The record ends with a qualifier (all) that defines default behavior. Example: "v=spf1 include:_spf.google.com ~all" allows Google's servers and softfails everything else.
Common Mechanisms
ip4: and ip6: specify allowed IP addresses or ranges. include: references another domain's SPF record. a: allows the domain's A record IP. mx: allows the domain's MX record IPs. exists: performs a DNS query for conditional logic. Each mechanism can have a qualifier prefix: + (pass), - (fail), ~ (softfail), ? (neutral).
The "all" Mechanism
The "all" mechanism matches everything not matched by previous mechanisms. "-all" means reject unauthorized senders (hard fail). "~all" marks them suspicious (soft fail, often spam folder). "?all" is neutral (no opinion). "+all" allows everyone (never use this—defeats the purpose of SPF). Most domains should use "-all" once properly configured.
DNS Lookup Limits
SPF allows a maximum of 10 DNS lookups. Each "include:", "a:", "mx:", and "exists:" mechanism counts as a lookup. Exceeding 10 causes SPF validation to fail (permerror). Use ip4: and ip6: (which don't count) when possible. Flatten nested includes if approaching the limit.