View source for SPF/term

{{fmt/title|SPF terms}}
==About==
SPF terms are either ''mechanisms'' (which are ways of evaluating and return pass/fail) or ''modifiers'' (which return additional information but do not evaluate). All terms are separated by spaces.

'''Mechanisms''' used by [[../]] are defined in [https://www.rfc-editor.org/rfc/rfc7208.html#section-5 RFC 7208 Section 5]. 

'''Modifiers''' used by SPF are defined in [https://www.rfc-editor.org/rfc/rfc7208.html#section-6 RFC 7208 Section 6].

Commonly-used argument names:
* {{fmt/arg|*-cidr-length}}: see {{l/sub|cidr-length}}
* {{fmt/arg|domain-spec}} defaults to {{arg|host domain}}.
** In some cases, this is parsed using the SPF macro language; it's not clear whether this applies to all cases, however.
** Either way, a domain name without any SPF markup will be interpreted literally (i.e. as you'd expect).
* {{fmt/arg|host domain}} is the domain whose DNS record we're constructing/examining
** The RFC calls this the {{fmt/xml/tag|target-name}}).

Terms used in explanations:
* {{fmt/arg|sender-ip}}: the IP address from which the message is being received
{| class="wikitable"
! code !! format || meaning
|-
| colspan=3 | '''Basic''' mechanisms:
|-
| <code>all</code>
| <code>all</code>
| a test that always matches; place as last mechanism in a record to provide an explicit default
|-
| <code>include</code>
| <code>include:{{arg|domain-spec}}</code>
| utility is unclear; includes SPF evaluation of the given domain, but not in a systematic way
|-
| colspan=3 | '''Designated sender''' mechanisms:
|-
| <code>a</code>
| style="white-space: nowrap;" | a{{fmt/opt|:{{fmt/arg|domain-spec}}}}{{fmt/opt|/{{fmt/arg|dual-{{l/sub|cidr-length}}}}}}</span>
| All the A or AAAA records for {{fmt/arg|domain-spec}} are tested. If {{fmt/arg|sender-ip}} is found among them, this mechanism matches.
* Use of A or AAAA depends on whether the connection is made over IPv4 or IPv6 respectively.
|-
| <code>mx</code>
| style="white-space: nowrap;" | mx{{fmt/opt|:{{fmt/arg|domain-spec}}}}{{fmt/opt|/{{fmt/arg|dual-{{l/sub|cidr-length}}}}}}
| All the A or AAAA records for all the MX records for {{fmt/arg|domain-spec}} are tested in order of MX priority. If {{fmt/arg|sender-ip}} is found among them, this mechanism matches.
* Use of A or AAAA depends on whether the connection is made over IPv4 or IPv6 respectively.
|-
| <code><s>ptr</s></code>
|
| (do not use<ref name=ptr-note />)
|-
|
<code>ip4</code><br>
<code>ip6</code>
| ip''N''{{fmt/opt|:{{fmt/arg|ip''N''-network}}}}{{fmt/opt|/{{fmt/arg|ip''N''-{{l/sub|cidr-length}}}}}}
| test whether sender is contained within a given IP network (address range)
* can also match a specific IP address, apparently
|-
| <code>exists</code>
| exists:{{fmt/arg|domain-spec}}
| construct a domain name in various ways, and use that for a DNS A record query.
* This allows for complex/fine-grained examination of the mail envelope to determine what is permitted
* {{fmt/arg|domain-spec}} is defined in [https://www.rfc-editor.org/rfc/rfc7208.html#section-7 Section 7].
|-
| colspan=3 | '''Modifiers''':
|-
| exp
| exp={{fmt/arg|domain}}
| The given {{fmt/arg|domain}} should have a DNS TXT record (interpreted using SPF's macro language) to get an explanation for FAIL results &ndash; typically a URL which is added to the SMTP error code. This feature is rarely used.
|-
| redirect
| redirect={{fmt/arg|domain-spec}}
| Replace this SPF record with the SPF record from {{fmt/arg|domain-spec}}.
* The macro-expanded domain is also substituted for the current domain in those lookups.
|}
==Clarification==
Where the syntax looks like this --
 {{fmt/arg|term}}{{fmt/opt|:{{fmt/arg|spec}}}}{{fmt/opt|/{{fmt/arg|dual-{{l/sub|cidr-length}}}}}}
-- valid combinations are:
 {{fmt/arg|term}}
 {{fmt/arg|term}}/{{arg|dual-{{l/sub|cidr-length}}}}
 {{fmt/arg|term}}:{{arg|spec}}
 {{fmt/arg|term}}:{{arg|spec}}/{{arg|dual-{{l/sub|cidr-length}}}}
==Links==
* {{wikipedia|Sender_Policy_Framework#Implementation}}
* [https://dmarcadvisor.com/spf-syntax-table/ SPF Record Syntax]
==Footnote==
<references>
<ref name=ptr-note>From the RFC (formatting added for clarity): {{fmt/quote|'''This mechanism is slow, it is not as reliable as other mechanisms in cases of DNS errors, and it places a large burden on the {{l/wp|.arpa}} name servers.'''  If used, proper PTR records have to be in place for the domain's hosts and the "ptr" mechanism SHOULD be one of the last mechanisms checked. After many years of SPF deployment experience, '''it has been concluded that it is unnecessary and more reliable alternatives should be used instead.'''  It is, however, still in use as part of the SPF protocol, so compliant check_host() implementations MUST support it.}}</ref>
</references>