---
title: "Understanding SPF mechanisms: a, mx, ip4, and include | AutoSPF"
description: "SPF has 8 mechanisms defined in RFC 7208: all, include, a, mx, ptr, ip4, ip6, and exists. The four most common are ip4 (authorize a specific IP), a (authorize the domain"
image: "https://autospf.com/og/blog/understanding-spf-mechanisms-a-mx-ip4-and-include.png"
canonical: "https://autospf.com/blog/understanding-spf-mechanisms-a-mx-ip4-and-include/"
---

Quick Answer

SPF has 8 mechanisms defined in RFC 7208 §5: all, include, a, mx, ptr, ip4, ip6, and exists. The four most commonly used are: ip4 (authorize a specific IPv4 address or range, 0 lookups), a (authorize the domain's A/AAAA records, 1 lookup), mx (authorize the domain's MX records and their A records, up to 10 lookups worst case), and include (delegate evaluation to another domain's SPF record, 1 lookup plus nested lookups).

Understanding SPF mechanisms: a, mx, ip4, and include

Your browser does not support the audio element.

[ Download episode](/audio/understanding-spf-mechanisms-a-mx-ip4-and-include.mp3) 

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Funderstanding-spf-mechanisms-a-mx-ip4-and-include%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Understanding%20SPF%20mechanisms%3A%20a%2C%20mx%2C%20ip4%2C%20and%20include&url=https%3A%2F%2Fautospf.com%2Fblog%2Funderstanding-spf-mechanisms-a-mx-ip4-and-include%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Funderstanding-spf-mechanisms-a-mx-ip4-and-include%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Funderstanding-spf-mechanisms-a-mx-ip4-and-include%2F&title=Understanding%20SPF%20mechanisms%3A%20a%2C%20mx%2C%20ip4%2C%20and%20include "Share on Reddit") [ ](mailto:?subject=Understanding%20SPF%20mechanisms%3A%20a%2C%20mx%2C%20ip4%2C%20and%20include&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Funderstanding-spf-mechanisms-a-mx-ip4-and-include%2F "Share via Email") 

![SPF mechanisms](https://media.mailhop.org/autospf/images/2025/06/spf-record-generator-6637.jpg) 

**SPF defines 8 mechanisms in [RFC 7208 §5](https://datatracker.ietf.org/doc/html/rfc7208#section-5): `all`, `include`, `a`, `mx`, `ptr`, `ip4`, `ip6`, and `exists`.** The four you will use 95% of the time are `ip4` (authorize a specific IPv4 address or CIDR range), `a` (authorize the domain’s A/AAAA records), `mx` (authorize the domain’s MX records), and `include` (delegate evaluation to another domain’s SPF record).

> “SPF syntax is deceptively simple,” says Adam Lundrigan, CTO of DuoCircle. “v=spf1 followed by mechanisms and a qualifier looks straightforward, but the evaluation semantics are surprisingly complex - mechanism ordering matters, the first match wins, and the difference between \~all and -all has real delivery consequences. We see records every week where a misplaced mechanism silently overrides the intended policy.”

For a deep dive into every SPF mechanism, qualifier, and modifier, see our [complete SPF record syntax guide](/blog/spf-record-syntax-complete-guide/).

Each mechanism has a specific DNS-lookup cost that counts against the RFC 7208 10-lookup limit:

- `ip4` / `ip6` \- **0 lookups** (literal IP, no DNS needed)
- `a` \- **1 lookup**
- `mx` \- **1 lookup** plus 1 per MX host returned (can silently blow the budget on domains with many MXs)
- `include` \- **1 lookup** plus whatever the included SPF record consumes recursively
- `exists` \- **1 lookup**
- `ptr` \- **1+ lookups** (and RFC 7208 §5.5 explicitly recommends AGAINST using it)

This guide walks through each of the four commonly-used mechanisms with exact syntax, the corner cases (multi-IP A records, MX hosts with many A records, recursive includes), and how to choose between `a`/`mx`/`ip4`/`include` when you have multiple options for the same set of sending IPs.

## ‘a’ mechanism

The ‘a’ mechanism in SPF tells receiving [mail servers](https://www.activecampaign.com/glossary/mail-server) that if a particular domain’s A or AAAA record points to the IP address sending the email, then consider it legit.

So basically, if an email is coming from an IP that’s listed in the domain’s A (ip4) or AAAA (ip6) records, and you’ve included the ‘a’ mechanism, then SPF passes.

For example; v=spf1 a -all

### When should you use the ‘a’ mechanism?

Use it when:

- Your email server shares the same IP address as your domain (e.g., website and mail server hosted on the same server).
- You’re running a small, simple setup, and your sending IP is directly tied to your domain’s [A/AAAA record](https://simple.wikipedia.org/wiki/AAAA%5Frecord).
- You’re sure that the domain’s A record will always reflect your mail server’s IP (this is key).

![domain's A record
](https://media.mailhop.org/autospf/images/2025/06/spf-record-tester-3004.jpg)

### When should you avoid the ‘a’ mechanism?

Refrain from using the ‘a’ mechanism when:

- You don’t know or control what the A record points to (e.g., you’re using [third-party hosting](https://www.lawinsider.com/dictionary/third-party-host) or CDNs).
- Your website and mail server are hosted separately on different IP addresses.
- _You want your SPF record to be explicit and maintainable, using ‘ip4’ or ‘include’ for clarity_.

Additionally, if your domain’s A record ever changes (such as during a server migration), you may inadvertently break [SPF](/blog/what-is-spf-email-a-guide-to-sender-validation-technology/) for your outbound emails without realizing it.

## ‘mx’ mechanism

In SPF, the ‘mx’ mechanism tells the receiving servers that it allows any server listed in the sending domain’s [MX record](https://dnsmadeeasy.com/resources/what-is-an-mx-rec) to send emails on behalf of the domain owner. It basically resolves the domain’s MX record to get the hostnames. Then it resolves the hostnames to IP addresses. If the IP address of the sender of your email matches one of the listed IP addresses, the [SPF check](/spf-record-tester/mimecast-spf-check/) passes.

![SPF check
](https://media.mailhop.org/autospf/images/2025/06/spf-validator-5608.jpg)

### When should you use the ‘mx’ mechanism?

Use the ‘mx’ mechanism if your email is being sent through the same mail servers that receive emails for your domain, i.e., your inbound and outbound mail servers are the same.

Common cases:

- You’re using your [web host](https://www.ibm.com/think/topics/web-hosting) or domain provider’s email service (like GoDaddy or Bluehost email).
- You have an on-premise mail server (like Microsoft Exchange) that handles both incoming and outgoing mail.
- _Your company uses a setup where the same provider handles both inbound and outbound mail flow_.

![ web host
](https://media.mailhop.org/autospf/images/2025/06/spf-flattening-2099.jpg)

### When should you avoid the ‘mx’ mechanism?

It’s not ideal to use the ‘mx’ mechanism if your outgoing emails don’t go through your MX servers. Here are the cases where this commonly happens:

- You use a third-party email-sending service (like Mailchimp, [Google Workspace](https://workspaceupdates.googleblog.com/), Zoho, Salesforce, etc.).
- Your domain receives emails through one server (MX) but sends through another (SMTP relay or API-based sender).
- You’re not sure what your MX records actually point to.

_Please note that if you use the ‘mx’ mechanism, your MX records should be well updated._ Also, keep checking the IPs they resolve to, as some services frequently rotate them or utilize [CDNs](https://www.techtarget.com/searchnetworking/definition/CDN-content-delivery-network) or load balancers. Therefore, there is a chance of a broken MX record.

## ‘ip4’ mechanism

The ‘ip4’ mechanism is used to explicitly authorize an IPv4 address (or range) to send emails on behalf of your domain.

_Example:_

```
v=spf1 ip4:192.0.2.0/24 -all
```

_This tells mail servers, ‘Hey, if an email comes from any IP in the 192.0.2.0/24 range, it’s legit for this domain.’_

![CRM tool
](https://media.mailhop.org/autospf/images/2025/06/spf-permerror-23070.jpg)

### When should you use the ‘ip4’ mechanism?

The ‘ip4’ mechanism is best used when:

- You manage your own mail server and know its IP.
- You’re using a service (such as a web host or [CRM tool](https://www.pipedrive.com/en/blog/crm-tool)) that provides you with a fixed sending IP.
- You want to manually allowlist known, static IPs instead of using the include mechanism.
- You have to custom-authorize a third-party sender that’s not covered by a known SPF ‘include.’

As a bonus benefit, it also helps avoid extra [DNS lookups](https://www.digicert.com/faq/dns/how-does-dns-lookup-work).

### When should you avoid the ‘ip4’ mechanism?

It’s better to be cautious:

- If the IP address is dynamic or changes frequently, because SPF won’t auto-update, you could break email delivery.
- _When you’re using large third-party platforms like Google Workspace or Mailchimp, they already provide ‘include’ records_.

Also, note that adding multiple ‘ip4’ entries in a single record can make your SPF record too lengthy and harder to manage.

![SPF record
](https://media.mailhop.org/autospf/images/2025/06/spf-lookup-2001.jpg)

## ‘include’ mechanism

The ‘include’ mechanism lets you authorize other domains to send email on your behalf. 

### When should you use the ‘include’ mechanism?

Use it when a third-party service sends email using your domain. This includes:

- Email marketing platforms (Mailchimp, SendGrid, Klaviyo, etc.)
- Transactional email services (Amazon SES, Postmark, etc.)
- CRM tools or helpdesks (HubSpot, Intercom, Freshdesk)
- Security services (like Proofpoint or Mimecast, if they handle [outbound mail](https://www.indeed.com/career-advice/career-development/what-is-email-outbound))
![CRM tools](https://media.mailhop.org/autospf/images/2025/06/spf-checker-2304.jpg) 

### When should you avoid the ‘include’ mechanism?

You don’t have to avoid using the ‘include’ mechanism; however, consider these points so that you don’t overuse it-

- Each ‘include’ adds to your 10 DNS lookup limit.
- Nested ‘include’ statements from other domains can silently blow past the limit.
- Never include domains you don’t fully control or trust.

If you have used too many ‘include’ statements and your SPF record has already exceeded the DNS lookup limit, then use [our automatic SPF flattening tool](/). _It will replace them with the IP addresses, which minimizes the need for lookups_. Reach out to us to know more about the tool or to get help with other SPF-related issues.

## Topics

[ SPF ](/tags/spf/)[ SPF Flattening ](/tags/spf-flattening/)[ SPF Flattening tool ](/tags/spf-flattening-tool/)[ SPF record ](/tags/spf-record/) 

![Adam Lundrigan](https://media.mailhop.org/autospf/images/authors/adam-lundrigan.jpg) 

[ Adam Lundrigan ](/authors/adam-lundrigan/) 

CTO

CTO of DuoCircle. Architect of AutoSPF's SPF flattening engine and DNS monitoring infrastructure.

[LinkedIn Profile →](https://www.linkedin.com/in/adamlundrigan/) 

## Ready to get started?

Try AutoSPF free — no credit card required.

[ Book a Demo ](/book-a-demo/) 

## Related Articles

[  Foundational 5m  What does the ‘null’ value mean in an SPF record?  Jul 11, 2025 ](/blog/what-does-the-null-value-mean-in-an-spf-record/)[  Foundational 4m  7 Myths and Misconceptions about Sender Policy Framework  May 31, 2024 ](/blog/7-myths-and-misconceptions-about-sender-policy-framework/)[  Foundational 17m  Free SPF Flattening Tool: Download the Best Software for Your Needs  Mar 26, 2025 ](/blog/free-spf-flattening-tool-download-best-software/)[  Foundational 12m  From Zero to Secure: Creating an SPF Record for Your Domain  Mar 11, 2026 ](/blog/from-zero-to-secure-creating-spf-record-for-your-domain/)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Understanding SPF mechanisms: a, mx, ip4, and include","description":"SPF has 8 mechanisms defined in RFC 7208: all, include, a, mx, ptr, ip4, ip6, and exists. The four most common are ip4 (authorize a specific IP), a (authorize the domain's A record), mx (authorize the domain's MX records), and include (delegate to another SPF record). Learn the exact semantics and lookup cost of each.","url":"https://autospf.com/blog/understanding-spf-mechanisms-a-mx-ip4-and-include/","datePublished":"2025-06-27T17:04:02.000Z","dateModified":"2026-04-18T02:36:41.000Z","dateCreated":"2025-06-27T17:04:02.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/adam-lundrigan/#person","name":"Adam Lundrigan","url":"https://autospf.com/authors/adam-lundrigan/","jobTitle":"CTO","description":"Adam Lundrigan is the Chief Technology Officer of DuoCircle, where he leads engineering and is responsible for the architecture of AutoSPF's SPF flattening engine and DNS monitoring infrastructure. His technical focus is the DNS-level behavior of SPF evaluation, the recursive include resolution logic that underpins flattening, and the monitoring systems that keep customer SPF records healthy as their upstream vendors change IP ranges.","image":"https://media.mailhop.org/autospf/images/authors/adam-lundrigan.jpg","knowsAbout":["SPF Flattening","DNS Architecture","Recursive Include Resolution","SaaS Engineering","DNS Monitoring","Infrastructure Automation"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/adamlundrigan/"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/understanding-spf-mechanisms-a-mx-ip4-and-include/"},"articleSection":"foundational","keywords":"SPF, SPF Flattening, SPF Flattening tool, SPF record","wordCount":1126,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/images/2025/06/spf-record-generator-6637.jpg","caption":"SPF mechanisms","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"When should you use the ‘a’ mechanism?","acceptedAnswer":{"@type":"Answer","text":"Use it when:"}},{"@type":"Question","name":"When should you avoid the ‘a’ mechanism?","acceptedAnswer":{"@type":"Answer","text":"Refrain from using the ‘a’ mechanism when:"}},{"@type":"Question","name":"When should you use the ‘mx’ mechanism?","acceptedAnswer":{"@type":"Answer","text":"Use the ‘mx’ mechanism if your email is being sent through the same mail servers that receive emails for your domain, i.e., your inbound and outbound mail servers are the same."}},{"@type":"Question","name":"When should you avoid the ‘mx’ mechanism?","acceptedAnswer":{"@type":"Answer","text":"It’s not ideal to use the ‘mx’ mechanism if your outgoing emails don’t go through your MX servers. Here are the cases where this commonly happens:"}},{"@type":"Question","name":"When should you use the ‘ip4’ mechanism?","acceptedAnswer":{"@type":"Answer","text":"The ‘ip4’ mechanism is best used when:"}},{"@type":"Question","name":"When should you avoid the ‘ip4’ mechanism?","acceptedAnswer":{"@type":"Answer","text":"It’s better to be cautious:"}},{"@type":"Question","name":"When should you use the ‘include’ mechanism?","acceptedAnswer":{"@type":"Answer","text":"Use it when a third-party service sends email using your domain. This includes:"}},{"@type":"Question","name":"When should you avoid the ‘include’ mechanism?","acceptedAnswer":{"@type":"Answer","text":"You don’t have to avoid using the ‘include’ mechanism; however, consider these points so that you don’t overuse it-"}}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Foundational","item":"https://autospf.com/foundational/"},{"@type":"ListItem","position":4,"name":"Understanding SPF mechanisms: a, mx, ip4, and include","item":"https://autospf.com/blog/understanding-spf-mechanisms-a-mx-ip4-and-include/"}]}
```