SPF Record Syntax: Mechanisms, Qualifiers, Modifiers, and Macros

August 3, 2026 by Meysam Azad spf spf-record-syntax spf-mechanisms spf-macros rfc-7208 dns email-authentication 22 min read Share document.querySelectorAll("[data-copy-url]").forEach(e=>{e.addEventListener("click",async()=>{const t=e.dataset.copyUrl;if(t)try{await navigator.clipboard.writeText(t);const c=e.querySelector(".icon-copy"),l=e.querySelector(".icon-check");c&&l&&(c.style.display="none",l.style.display="block",setTimeout(()=>{c.style.display="block",l.style.display="none"},2e3))}catch{}})}) SPF Record Syntax: Mechanisms, Qualifiers, Modifiers, and Macros SPF record syntax follows one shape: a single DNS TXT record that starts with v=spf1, followed by space-separated terms — mechanisms with optional qualifiers, then modifiers — evaluated left to right until the first match. Here is a complete record: v=spf1 ip4:192.0.2.0/24 include:_spf.example.com -all That one line authorizes a /24 network and a third party’s servers, then fails everything else. Every rule governing it lives in RFC 7208, the SPF standard published in April 2014. This page is the full reference: every mechanism, every qualifier, both modifiers, the complete macro table, evaluation order, DNS lookup limits, and record placement rules — each with the RFC 7208 section that defines it. If you want protocol fundamentals first — why SPF exists and how it fits with DKIM and DMARC — start with our SPF guide. If you build and maintain records, bookmark this. SPF Record Syntax at a Glance An SPF record is one string of text in the RDATA of a single TXT record, and its grammar has exactly three kinds of parts: a version tag, mechanisms (each with an optional qualifier), and modifiers. The version tag must be exactly v=spf1 — a record starting v=spf10 is discarded, not partially matched (§4.5). Every SPF record is the same three kinds of parts: a version tag, mechanisms with optional qualifiers, and modifiers. The grammar in brief, from §3 and §4.6.1: PartFormRoleVersionv=spf1, always first, exactSelects the record (§4.5)Mechanism[qualifier]name[:arg][/cidr]Tested against the client IP; can match or not match (§4.6.2)Qualifier+ - ~ ? before mechanismThe result returned when its mechanism matches (§4.6.2)Modifiername=value, at most once eachExtra information; never matched (§6) The three kinds of parts in SPF record syntax Terms are separated by spaces. Mechanism names are case-insensitive, and terms containing none of =, :, or / are mechanisms (§4.6.1). One syntax error anywhere invalidates the whole record: check_host() — the receiver’s evaluation routine, as the RFC names it — validates SPF syntax first and returns PermError immediately if anything is malformed, without evaluating a single term (§4.6). That is why one stray character can fail authentication for every message a domain sends. SPF Mechanisms Eight mechanisms exist, and each either matches the connecting IP or does not. RFC 7208 §5 splits them into basic framework mechanisms (all, include) and designated-sender mechanisms (a, mx, ptr, ip4, ip6, exists). Before the full table: most real-world records use only include, ip4, ip6, and all — the rest of this reference exists so you can read other people’s records, not because your own needs them. MechanismSyntaxMatches when…Counts toward 10-lookup limit?RFC §allallAlwaysNo§5.1includeinclude:domainThe referenced record returns PassYes§5.2aa[:domain][/cidr]Client IP is among the domain’s A/AAAA addressesYes§5.3mxmx[:domain][/cidr]Client IP is an address of one of the domain’s MX hostsYes (plus per-MX address caps)§5.4ptrptr[:domain]Reverse DNS validates into the target domainYes§5.5ip4ip4:network[/cidr]Client IP is inside the IPv4 networkNo§5.6ip6ip6:network[/cidr]Client IP is inside the IPv6 networkNo§5.6existsexists:domainThe constructed domain has any A recordYes§5.7 All eight SPF mechanisms with syntax, match condition, and DNS lookup cost function L(){document.querySelectorAll(".data-tab