Understanding SPF Record Syntax: Mechanisms, Qualifiers, Modifiers, and Macros

SPF Record Fundamentals

An SPF record is a single text string within a TXT record's RDATA, composed of a version tag, mechanisms, and modifiers. The version tag must be exactly 'v=spf1'; any deviation, such as 'v=spf10', causes the record to be discarded. Terms within the record are separated by spaces, and mechanism names are case-insensitive.

Syntax Validation and Error Handling

A single syntax error anywhere in an SPF record invalidates the entire record. The receiver's evaluation routine, check_host(), validates SPF syntax first and returns a PermError immediately if any part is malformed, without evaluating individual terms. This means a minor error can prevent authentication for all messages sent from that domain.

Key SPF Mechanisms

There are eight defined SPF mechanisms, each determining if the connecting IP matches. These are categorized into basic framework mechanisms ('all', 'include') and designated-sender mechanisms ('a', 'mx', 'ptr', 'ip4', 'ip6', 'exists'). In practice, most real-world SPF records primarily utilize 'include', 'ip4', 'ip6', and 'all'.

Mechanism Specifics: 'all' and 'include'

The 'all' mechanism always matches and is typically placed at the end of an SPF record as the explicit default. Any mechanisms listed after 'all' are ignored, and any 'redirect=' modifier is also ignored if 'all' is present. If a record lacks a trailing 'all' or 'redirect=', it silently defaults to Neutral. The 'include' mechanism recursively evaluates the referenced domain's SPF record, matching only if that evaluation returns Pass. A Fail, Softfail, or Neutral result within an included record means 'no match here, continue evaluation'. If the included domain has no SPF record, 'include' returns a PermError.

Mechanism Specifics: 'a' and 'mx'

The 'a' mechanism matches if the client IP is one of the target domain's A or AAAA addresses. The 'mx' mechanism matches if the client IP is an address of one of the domain's MX hosts. Both 'a' and 'mx' default to the current domain if no argument is provided and support dual CIDR notation.