Skip to main content
Relaymetry

SPF record syntax: every mechanism, qualifier, and the 10-lookup limit

An SPF record is a single DNS TXT record, starting with v=spf1, that lists which servers may send mail for your domain. It is read left to right, and the first mechanism that matches the connecting IP decides the result (RFC 7208 section 4.6.2). A mechanism decides whether the IP matches; the qualifier in front of it (+, -, ~, ?) decides what that match returns, and no more than 10 of its terms may trigger a DNS lookup.

Quick answer

An SPF record is a single DNS TXT record, published at your domain's name, that lists which servers may send mail using that domain. It begins with v=spf1 and reads left to right: the first mechanism that matches the connecting IP ends evaluation and decides the result, and nothing after it is consulted (RFC 7208 §4.6.2). A typical record looks like this:

example.com.  3600  IN  TXT  "v=spf1 include:_spf.google.com ip4:198.51.100.10 ~all"

That line authorises the hosts in Google's own SPF record and the address 198.51.100.10, then softfails everything else. The rest of this reference is what every part between v=spf1 and the trailing all actually means.

One record, one TXT string

A domain publishes exactly one v=spf1 record, and it lives in a single TXT string. Two v=spf1 records at the same name do not add up: they are a permerror that stops SPF passing for every message. If you send through more than one platform, you merge those platforms into the one record rather than publishing a second. For how SPF sits alongside DKIM and DMARC, see email authentication explained.

Mechanisms

A mechanism is a test against the connecting IP. SPF defines eight of them (RFC 7208 §5):

  • all: always matches. It is the catch-all you place last as an explicit default (§5.1).
  • include:<domain>: runs a full SPF check on another domain and matches only if that check returns pass (§5.2). This is how you authorise a mail provider that publishes its own record.
  • a or a:<domain>: matches if the connecting IP is one of the domain's A or AAAA addresses (§5.3). With no domain given, it uses the current domain.
  • mx or mx:<domain>: matches if the IP is one of the addresses of the domain's MX hosts (§5.4).
  • ip4:<network> and ip6:<network>: match if the IP falls inside the given CIDR block (§5.6). With no prefix length, ip4 defaults to /32 and ip6 to /128, an exact match.
  • exists:<domain>: macro-expands a name and matches if that name has any A record (§5.7), which lets a record ask a policy question keyed on the sender or IP.
  • ptr or ptr:<domain>: reverse-maps the IP, then forward-confirms the resulting names against the domain (§5.5). RFC 7208 says this mechanism SHOULD NOT be published, because it is slow, unreliable under DNS errors, and heavy on the reverse-DNS servers. Support it if you read it, but do not write it.

The four qualifiers

Every mechanism can carry a qualifier that sets the result returned when the mechanism matches (RFC 7208 §4.6.2):

  • + pass: the connecting IP is authorised.
  • - fail: the IP is not authorised. -all is a hardfail.
  • ~ softfail: the IP is probably not authorised, but the receiver should accept and mark the message rather than reject it. ~all is a softfail.
  • ? neutral: the record makes no assertion either way.

The qualifier is optional and defaults to +, so a bare mx means exactly the same as +mx. This is also the cleanest way to state the difference between a mechanism and a qualifier: the mechanism decides whether the connecting IP matches, and the qualifier decides what result a match produces. The qualifier you attach to the final all is the one that matters most, and ~all versus -all has its own page.

Evaluation order: first match wins

Terms are evaluated from left to right. Each mechanism is checked in turn, and the first one that matches ends evaluation and returns its qualifier's result (RFC 7208 §4.6.2). Anything to the right of the first match is never reached, which is why all belongs at the very end: it matches every address, so any mechanism placed after it is dead. If no mechanism matches and no redirect is present, the result is neutral, exactly as if the record had ended in ?all (RFC 7208 §4.7).

The redirect and exp modifiers

Modifiers appear at most once each and their order does not matter (RFC 7208 §6):

  • redirect=<domain>: if no mechanism has matched, evaluation continues with that domain's SPF record, and its result becomes your result (§6.1). Unlike include, which contributes a single match on pass, redirect hands over the whole outcome, so it is for pointing several of your own domains at one shared record, not for authorising a third party.
  • exp=<domain>: names a domain whose TXT record supplies an explanation string, returned to the sender when the check ends in fail (§6.2). It changes no result; it only annotates a rejection.

Because a redirect runs only when nothing matched, a record that ends in an all mechanism never reaches its redirect. In practice you use one or the other to terminate a record, not both.

The 10 DNS-lookup limit

This is the rule that quietly breaks records that used to work. An evaluator MUST limit the number of DNS-querying terms to 10 during a single SPF check (RFC 7208 §4.6.4). Exceed it and the result is permerror, which means SPF neither passes nor cleanly fails and can silently drop your DMARC alignment on the SPF path.

Only some terms count. The include, a, mx, ptr, and exists mechanisms and the redirect modifier each cost one lookup against the limit of 10. The all, ip4, and ip6 mechanisms require no DNS at all and cost nothing; the exp modifier is also exempt, because its lookup happens after the record has finished evaluating. A nested include is the trap here: every lookup inside the record it pulls in counts too, so one third-party include can consume most of your budget by itself.

Two narrower limits sit underneath the main one (§4.6.4). A single mx term may not resolve more than 10 mail hosts, a single ptr term is capped at 10 address records, and no more than two "void" lookups (queries that return no record or a name-error) are allowed across the whole evaluation. Crossing the 10-term cap is common enough that fixing the SPF too-many-DNS-lookups permerror is a task of its own, and adding a new sending platform is the usual trigger. You can check how many lookups your live record uses before it bites.

Macros

SPF can build DNS names on the fly with macros (RFC 7208 §7). A macro is a percent sign and a letter in braces: %{s} is the sender address, %{l} its local part, %{o} and %{d} the sender and the checked domain, %{i} the client IP, %{h} the HELO or EHLO name, and %{p} the validated reverse-DNS name. The escapes %%, %_, and %- stand for a literal percent, a space, and a URL-encoded space. Macros mostly appear inside an exists mechanism to look up per-sender or per-IP policy; most ordinary records never need one.

Frequently asked questions

What does ~all mean in an SPF record?

~all is the "all" mechanism with the softfail qualifier "~". It matches every address that no earlier mechanism authorised and returns softfail, which asks the receiver to accept the message but treat it as suspicious rather than reject it (RFC 7208 section 4.6.2). -all is the hardfail equivalent and ?all is neutral.

What is the difference between an SPF mechanism and a qualifier?

A mechanism (all, include, a, mx, ip4, ip6, exists, ptr) is a test that decides whether the connecting IP matches. A qualifier (+ pass, - fail, ~ softfail, ? neutral) decides what result that match returns. The qualifier is optional and defaults to +, so a bare mechanism is a pass.

How many DNS lookups does an SPF record allow?

An SPF evaluator must limit DNS-querying terms to 10 per check (RFC 7208 section 4.6.4). The include, a, mx, ptr, and exists mechanisms and the redirect modifier each count as one; all, ip4, ip6, and the exp modifier do not count. Exceeding 10 returns permerror, so SPF no longer passes.

How is an SPF record evaluated?

Left to right, first match wins. Each mechanism is checked in turn, and the first one that matches the connecting IP ends evaluation and returns its qualifier result (RFC 7208 section 4.6.2). Anything after the first match is never reached, which is why all belongs at the end of the record.

What is the difference between the include mechanism and the redirect modifier?

include runs a full SPF check on another domain and contributes a single match when that check passes, so it is used to authorise a third-party sender. redirect hands the entire result over to another domain when no mechanism matched, so it is used to point several of your own domains at one shared record. Both count against the 10-lookup limit.

Can a domain have more than one SPF record?

No. A domain must publish exactly one v=spf1 TXT record. Two v=spf1 records at the same name produce a permerror and SPF stops passing for every message. To add another sender you merge it into the single existing record.

Other SPF, DKIM & DMARC reference pages

References

Browse all guides →