SPF/term

SPF terms

About

SPF terms are either mechanisms (which are ways of evaluating and return pass/fail) or modifiers (which return additional information but do not evaluate). All terms are separated by spaces.

Mechanisms used by SPF are defined in RFC 7208 Section 5.

Modifiers used by SPF are defined in RFC 7208 Section 6.

Commonly-used argument names:

• <*-cidr-length>: see cidr-length
• <domain-spec> defaults to <host domain>.
• <host domain> is the domain whose DNS record we're constructing/examining
  • The RFC calls this the <target-name>).
• <ip>, aka "the IP": I thought this meant one thing, but now I'm not sure.

code	format	meaning
Basic mechanisms:
all	all	a test that always matches; place as last mechanism in a record to provide an explicit default
include	include:<domain-spec>	utility is unclear; includes SPF evaluation of the given domain, but not in a systematic way
Designated sender mechanisms:
a	a[:<domain-spec>] [ <dual-cidr-length> ]	match if <domain-spec> points to one of the <host domain>'s IP addresses
mx	mx[:<domain-spec>] [ <dual-cidr-length> ]	do an MX lookup on the <host domain>, then look up address for each MX name returned... It's not yet clear what the pass/fail criteria are. Multiple MX mechanisms may be listed.
ptr		(do not use)
ip4 ip6	ipN[:<ipN-network>] [ <ipN-cidr-length> ]	test whether sender is contained within a given IP network can also match a specific IP address, apparently
exists	exists:<domain-spec>	construct a domain name in various ways, and use that for a DNS A record query. This allows for complex/fine-grained examination of the mail envelope to determine what is permitted <domain-spec> is defined in Section 7.
Modifiers: