LANGUAGES Signal 536
SPF Record Syntax: Mechanisms, Qualifiers, Modifiers, and Macros
Engineers who configure or troubleshoot email authentication must know how each term is evaluated left‑to‑right, how qualifiers affect the result, and how modifiers add extra information without being matched. Misplacing a mechanism or adding an invalid character can cause the whole record to be rejected, leading to PermError for all outgoing mail. Understanding the DNS lookup cost of mechanisms like include and mx helps stay within the 10‑lookup limit and avoid unexpected failures.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
An SPF record consists of a version tag, zero or more mechanism‑qualifier pairs, and at most two modifiers, all evaluated sequentially until the first match.
Qualifiers (+, -, ~, ?) determine the outcome returned when a mechanism matches, while modifiers such as redirect= and exp= provide additional behavior without being tested against the client IP.
Most mechanisms (include, a, mx, ptr, exists) count toward the 10 DNS lookup limit, whereas ip4 and ip6 do not, and any syntax error causes the receiver to return PermError before evaluating any term.
THE CLUSTER