Definition
The SPF redirect modifier is a directive that instructs a receiving server to evaluate another domain's SPF record in place of the current one, and to use that result as the final SPF result. It is written as redirect=domain.com and appears at the end of an SPF record, acting as an unconditional delegation of the SPF check to another domain.
How It Works
When a receiver processes an SPF record and encounters redirect=, it stops evaluating the current record and begins evaluating the referenced domain's record. The result of that referenced record — pass, fail, softfail, or neutral — becomes the result for the original domain as well.
For example, if example.net publishes:
v=spf1 redirect=example.com
Then a check against example.net behaves exactly as if the query were made against example.com's SPF record.
This differs from the include mechanism in an important way. include pulls in another record's mechanisms but returns a special "match" result that the including record must then handle, whereas redirect fully replaces the evaluation and adopts the referenced result directly.
Why It Matters
redirect is useful for organisations that want one canonical SPF record to govern many domains. A company with multiple domains can publish a single master record and have every other domain redirect to it, so that changing the master updates all of them at once. This reduces the risk of drift between domains.
However, redirect has limitations and risks:
- Because it delegates unconditionally, any problem in the master record affects every redirecting domain.
- It cannot be combined with a terminating
allmechanism, sinceredirectitself is the terminator. - It is less common than
includeand can be overlooked during troubleshooting, since a redirecting domain's own record says nothing about its IPs.
For most multi-domain setups, include is the more common and flexible choice, but redirect remains a valid tool for strict delegation to a single source of truth.
Example
A university owns uni.edu and several subdomains used by departments. It publishes one master SPF record at _spf.uni.edu and has each department domain publish v=spf1 redirect=_spf.uni.edu. Updating the master record updates every department's SPF result without editing each domain.
Was this useful?
Related Glossary Terms
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
DKIM Alignment
DKIM alignment is the DMARC requirement that the domain in the From header matches the domain in the DKIM signature, confirming the visible sender domain is authenticated.
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.
DMARC Aggregate Report
A DMARC aggregate report is a machine-readable XML summary that receiving mail servers send to domain owners daily to show authentication results for their email traffic.
DMARC Forensic Report
A DMARC forensic report is a detailed message-level copy of an individual email that failed DMARC authentication, sent to the domain owner to help diagnose spoofing and misconfiguration.
Frequently Asked Questions
`include` evaluates another record and returns a match if that record passes, then continues evaluating the rest of the current record. `redirect` replaces the current evaluation entirely and adopts the other record's result as the final answer.
Use `redirect` when you want one SPF record to be the single authority for many domains, and you do not need to add any mechanisms of your own. For most cases where you combine your own IPs with a provider's, `include` is more appropriate.
No. `redirect` is a modifier that acts as the terminal step of evaluation, so it cannot appear alongside a terminating `all` mechanism. The referenced record should itself end with an appropriate `all` qualifier.
Yes, indirectly. The SPF result produced by the redirected record feeds into DMARC evaluation, so a correct redirect can help messages pass, while a broken master record can cause widespread failures.