SPF record syntax
An SPF record is a single DNS TXT record that starts with v=spf1 and
lists the mechanisms describing who may send mail for your domain. Here is the full syntax.
Anatomy of a record
v=spf1 include:spf.protection.outlook.com ip4:198.51.100.0/24 a mx -allv=spf1— version tag; every record must start with it.- Mechanisms —
include,a,mx,ip4,ip6,exists,ptr(deprecated),all. all— always last; sets the default result.
Mechanisms
| Mechanism | Authorizes | Counts as lookup? |
|---|---|---|
ip4: / ip6: | a specific IP or CIDR range | No |
a | the domain’s A/AAAA record IPs | Yes |
mx | the domain’s MX host IPs | Yes |
include: | another domain’s SPF record | Yes (recursively) |
exists: | a dynamic macro check | Yes (one) |
redirect= | replaces the record with another’s | Yes |
ptr | reverse-DNS (deprecated — don’t use) | Yes |
Qualifiers
Each mechanism can carry a qualifier that sets the result when it matches:
Size and count limits
- A single TXT string is capped at 255 characters; longer records are split into multiple quoted strings that are concatenated — still one record.
- At most 10 lookup mechanisms and 2 void lookups (see the lookup limit).
- Exactly one
v=spf1record per domain.
Common syntax mistakes
- Two
v=spf1records on one domain → permerror. - Anything after
all(it’s ignored, and signals a mistake). - Using
ptr(deprecated and unreliable). - A stray
includethat no longer resolves → void-lookup permerror.
Frequently asked questions
What is the correct SPF record format?
A single TXT record beginning with
v=spf1, followed by mechanisms (include, ip4, a, mx, etc.) and ending with an all qualifier such as ~all or -all.What is the 255-character limit in SPF?
A single DNS TXT string can be at most 255 characters. Longer SPF records are published as multiple quoted strings that DNS concatenates — still a single valid record.
What does ~all vs -all mean?
~all is softfail (mark suspicious), -all is hardfail (reject). The all mechanism sets the result for senders not otherwise matched.