Definition
SPF (Sender Policy Framework) mechanisms are the building blocks of an SPF DNS record. Each mechanism defines a rule for determining whether a sending host is authorised to send email on behalf of a domain. The seven standard mechanisms are a (the domain's A record), mx (the domain's MX servers), include (delegation to another domain's SPF record), ip4 (IPv4 address range), ip6 (IPv6 address range), exists (arbitrary domain existence check), and ptr (reverse DNS lookup, now deprecated).
Each mechanism is evaluated in left-to-right order, and the first matching mechanism determines the result. Mechanisms are modified by qualifiers: + for pass (default if no qualifier is specified), - for fail (hard fail), ~ for softfail, and ? for neutral. The choice of qualifier determines how receiving mail servers treat messages that match that mechanism. The all mechanism at the end of the record catches all remaining senders that did not match any earlier mechanism.
Best Practices
Always end your SPF record with a hard fail (-all) once you have a complete inventory of all authorised sending sources. A hard fail tells receiving servers to reject unauthorised email outright. Use softfail (~all) during a transition period while you identify and add all legitimate sources.
Limit SPF DNS lookups to a maximum of ten per record to avoid the permanent SPF permerror that occurs when the lookup limit is exceeded. Each include mechanism counts as one lookup, and both the a and mx mechanisms can trigger additional lookups if they reference domains with multiple IP addresses.
List explicit IP address ranges using ip4 and ip6 mechanisms whenever possible instead of include mechanisms. Direct IP statements are simpler, faster to resolve, and do not consume DNS lookup budget. Reserve include for delegating to third-party email services that provide their own SPF records.
Avoid the deprecated ptr mechanism entirely. It is slow, unreliable, and has been removed from the SPF specification as a valid mechanism. All major mailbox providers ignore ptr checks, so it provides no security value.
Regularly audit your SPF record. When you change email service providers or retire sending infrastructure, remove the corresponding mechanisms to keep your record lean and within the ten-lookup limit. Stale includes that point to deleted DNS records can cause intermittent deliverability failures.
Related Glossary Terms
Bounce Classification
Bounce classification uses SMTP codes (550, 551, 552, 553, 554, 450, 451, 452) and enhanced status codes to categorise permanent and transient delivery failures.
DMARC Alignment
DMARC identifier alignment determines whether the domain in the From header matches the domains used in SPF and DKIM authentication. Strict or relaxed.
DMARC Policy Tags
DMARC DNS record tags including v, p, sp, rua, ruf, pct, adkim, aspf, fo, rf, and ri control authentication policy, reporting, and alignment enforcement.
Email Active Subscriber
An active email subscriber has opened or clicked an email within a defined recency period, typically 30-90 days by industry. Active subscriber rate of 40-60% is typical for healthy email lists.
Email BIMI VMC
BIMI Verified Mark Certificate (VMC) certifies brand logo ownership for display in supporting email clients. VMCs cost £1,500-2,000+ per year per logo and require DMARC reject or quarantine policy plus SVG logo format.
Email Blacklist
An email blacklist (DNSBL) is a real-time database of IP addresses or domains known for sending spam or unwanted email.
Frequently Asked Questions
When a mechanism matches the sending host, the associated qualifier determines the outcome. If the qualifier is `+` (pass), the message proceeds to the next authentication check. If it is `-` (fail), the receiving server rejects the message. If it is `~` (softfail), the message is accepted but flagged as suspicious.
The `include` mechanism delegates authority to another domain's SPF record. When the receiving server encounters an `include`, it performs a DNS lookup on the referenced domain, retrieves its SPF record, and evaluates it as if it were part of the original record. If the included record passes, the mechanism matches.
The SPF specification imposes a ten-lookup limit to prevent denial-of-service attacks caused by deeply nested SPF records that would consume excessive server resources. Each `include`, `a`, `mx`, `redirect`, and `exists` mechanism can count toward this limit depending on how they are used. Records exceeding ten lookups result in a permanent error.
`-all` (hard fail) tells receiving servers that any sender not matching an earlier mechanism is definitely unauthorised and should be rejected. `~all` (softfail) tells receiving servers that non-matching senders are probably unauthorised but should be accepted for testing purposes. Organisations should use `~all` during discovery and transition to `-all` once confident in their SPF record.
Yes, SPF functions independently of DMARC. However, without DMARC, receiving servers do not have a published policy for how to handle SPF and DKIM failures. DMARC gives senders control over what happens when authentication checks fail and provides reporting that helps diagnose delivery issues.