SPF/term

SPF mechanisms

About

Mechanisms used by SPF are defined in RFC 7208 Section 5. We'll refer to {the domain to which a DNS record refers} as the <host domain> (although the RFC refers to it as <target-name>).

Mechanisms are separated by spaces.

Commonly-used terms:

• <ip>, aka "the IP"
• <*-cidr-length>: see cidr-length
• <domain-spec> defaults to <host domain>.

code	format	meaning
Basic:
all	all	a test that always matches; place as last mechanism in a record to provide an explicit default
include	include:<domain-spec>	utility is unclear; includes SPF evaluation of the given domain, but not in a systematic way
Designated sender:
a	a[:<domain-spec>] [ <dual-cidr-length> ]	match if <domain-spec> points to one of the <host domain>'s IP addresses
mx	mx[:<domain-spec>] [ <dual-cidr-length> ]	do an MX lookup on the <host domain>, then look up address for each MX name returned... It's not yet clear what the pass/fail criteria are. Multiple MX mechanisms may be listed.
ptr		(do not use)
ip4 ip6	ipN[:<ipN-network>] [ <ipN-cidr-length> ]	test whether sender is contained within a given IP network can also match a specific IP address, apparently
exists	exists:<domain-spec>	construct a domain name in various ways, and use that for a DNS A record query. This allows for complex/fine-grained examination of the mail envelope to determine what is permitted <domain-spec> is defined in Section 7.