--- title: "Which IP addresses you should not add to your SPF records? | AutoSPF" description: "The foremost step of creating an SPF record is enlisting all the IP addresses and mail servers that you want to add to it." image: "https://autospf.com/og/blog/which-ip-addresses-you-should-not-add-to-your-spf-records.png" canonical: "https://autospf.com/blog/which-ip-addresses-you-should-not-add-to-your-spf-records/" --- Quick Answer The foremost step of creating an SPF record is enlisting all the IP addresses and mail servers that you want to add to it. These should be all the authorized sources from which you, your employees, third-party vendors, and other brand representatives can send emails. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fwhich-ip-addresses-you-should-not-add-to-your-spf-records%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Which%20IP%20addresses%20you%20should%20not%20add%20to%20your%20SPF%20records%3F&url=https%3A%2F%2Fautospf.com%2Fblog%2Fwhich-ip-addresses-you-should-not-add-to-your-spf-records%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fwhich-ip-addresses-you-should-not-add-to-your-spf-records%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fwhich-ip-addresses-you-should-not-add-to-your-spf-records%2F&title=Which%20IP%20addresses%20you%20should%20not%20add%20to%20your%20SPF%20records%3F "Share on Reddit") [ ](mailto:?subject=Which%20IP%20addresses%20you%20should%20not%20add%20to%20your%20SPF%20records%3F&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fwhich-ip-addresses-you-should-not-add-to-your-spf-records%2F "Share via Email") ![IP addresses](https://media.mailhop.org/autospf/images/2024/06/spf-lookup-2463.jpg) The foremost step of creating an SPF record is enlisting all the IP addresses and mail servers that you want to add to it. These should be all the authorized sources from which you, your employees, [third-party vendors](/blog/including-third-party-vendors-in-your-spf-record-is-important/), and other brand representatives can send emails. _Per [RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208), SPF evaluation is capped at 10 DNS mechanism lookups and 2 void lookups per check - exceeding either limit produces a `PermError` that fails authentication for every message from the domain._ _The reason you need to be careful while listing the IP addresses is that if you miss adding any one of them, then emails sent from that IP address will not pass the SPF authentication checks_. In simpler words, such emails won’t land in the inboxes of the desired recipients; they will either get placed in the [spam folders](https://www.foxnews.com/tech/big-bucks-hiding-spam-folder) or bounce back. On the other hand, if you mistakenly add an IP address that isn’t authorized to send emails on behalf of your business, this will act as a vulnerability, allowing unapproved and illegitimate people to send emails that pass [SPF authentication checks](/spf-validation-failed-meaning-and-troubleshooting-methods/?%5Fgl=1%2A1hlttog%2A%5Fup%2AMQ..%2A%5Fga%2AODg2ODMyNTc4LjE3MTkyOTM5Mjc.%2A%5Fga%5F5J0R8M01Y5%2AMTcxOTI5MzkyNy4xLjEuMTcxOTI5Mzk5Ni4wLjAuMA..) and get placed in the recipients’ inboxes. Such security loopholes open avenues for phishing and spoofing attacks in your name. _Threat actors send fraudulent and unsolicited emails posing as someone from your company_. Since such messages come from trusted sources, recipients tend to share sensitive details, transfer money, click [malicious links](https://cyberguy.com/news/scammers-are-using-fake-news-and-malicious-links-to-target-you-in-emotional-facebook-phishing-trap/), download malware-infected files, etc. ![spot phishing emails](https://media.mailhop.org/autospf/images/2024/06/spf-record-office-365-8.jpg) So, to save you from these faux pas, we are sharing the types of IP addresses you should avoid adding to your SPF records. ## Refrain from adding these types of IP addresses ### Unauthorized public IP addresses _Include IP addresses that are clearly authorized and designated to be used for sending emails_. Adding unauthorized IP addresses creates opportunities for spoofing and phishing, damaging your [brand’s reputation](https://www.business-reporter.co.uk/risk-management/brand-protection-a-critical-part-of-information-security) and leading to potential blocklisting. ### Dynamic IP addresses [Dynamic IP addresses](https://www.techtarget.com/whatis/definition/dynamic-IP-address#:~:text=A%20dynamic%20IP%20address%20is,different%20locations%20on%20a%20network.) should be excluded from your SPF record because they change frequently and are often linked to residential ISPs. They are unstable and non-reliable, can change with the connection session, and are usually blocked by major email service providers because of their association with [spam and malware](https://www.euronews.com/next/2024/03/07/this-ai-worm-can-steal-private-data-and-send-spam-emails). ![spf record statistics](https://media.mailhop.org/autospf/images/2024/06/Latest-SPF-Record-Statistics-418x1024.jpg) ### Private IP addresses Private IP addresses (e.g., those in the ranges 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are not routable on the public internet and are meant for internal network use. Since they can’t be reached from outside your internal network, they lead to [SPF failures](/blog/understanding-how-to-fix-spf-failure/) when external email servers try to validate the SPF record. ### IP addresses of unauthorized third-party vendors Include the IP addresses only of third-party services you use and are allowed to send emails on your behalf, such as marketing platforms and CRMs. _Also, if you switch to new vendors, exclude the IP addresses of the old ones_. The addition of unauthorized and obsolete services creates opportunities for [threat actors](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a) to abuse your domain for malicious activities. ### Blocklisted IP addresses Avoid IP addresses that are on blocklists, as it will result in your emails being marked as spam or getting rejected entirely by recipients’ mail servers. So, don’t skip to frequently check the IP addresses you have added or are planning to add against major blocklists. It’s a part of SPF management to ensure the added IPs are clean. ## What Are Best Practices for to maintain a proper SPF record? Deploying SPF for your domain is not a one-time job but a continued string of effort. Here are the things you need to take care of- ![email delivery](https://media.mailhop.org/autospf/images/2024/06/spf-lookup-2464.jpg) - Collect all IP addresses from your [email servers](https://www.ipxo.com/blog/what-is-an-email-server/), authorized third-party services, and any other legitimate sources. - Regularly review and update your [SPF record](/blog/spf-records-benefits-uses-and-generation/) to remove any IP addresses that are no longer authorized. - Monitor email delivery reports and [SPF validation](/spf-validation-failed-meaning-and-troubleshooting-methods/spf-validation-error/?%5Fgl=1%2Arg3nn%2A%5Fup%2AMQ..%2A%5Fga%2AMTc4NzcyOTIyMS4xNzE5MzAwNDc5%2A%5Fga%5F5J0R8M01Y5%2AMTcxOTMwMDQ3OC4xLjEuMTcxOTMwMDk2NS4wLjAuMA..) results to ensure compliance. - _Use the ‘include’ mechanisms for third-party services after verifying their IP ranges_. - Use -all or \~all at the end of your SPF record to indicate a [hardfail or softfail](/blog/spf-softfail-or-spf-hardfail/) for any unauthorized IPs attempting to send emails. This is how a valid and well-structured SPF record looks like- ``` v=spf1 ip4:203.0.113.5 ip4:198.51.100.23 include:spf.thirdpartyservice.com -all ``` By following these guidelines and ensuring you only include authorized, static, and non-blocklisted IP addresses, you can maintain a secure and effective SPF record that helps protect your domain from misuse. If you feel stuck at any point or need an [SPF flattening tool](/) to get rid of the ‘too many [DNS lookups](https://www.techopedia.com/definition/29029/dns-lookup)’ error, then [reach out to us](/contact-us/?%5Fgl=1%2At1x90q%2A%5Fup%2AMQ..%2A%5Fga%2ANDUwMDcwMzAwLjE3MTkyODYwNzk.%2A%5Fga%5F5J0R8M01Y5%2AMTcxOTI4NjA3OC4xLjAuMTcxOTI4NjA3OC4wLjAuMA..). Our automatic tools and team of experts will sort your issues. ## Topics [ SPF ](/tags/spf/)[ SPF Flattening tool ](/tags/spf-flattening-tool/)[ SPF record ](/tags/spf-record/) ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) ## Related Articles [ Foundational 6m Understanding SPF mechanisms: a, mx, ip4, and include Jun 27, 2025 ](/blog/understanding-spf-mechanisms-a-mx-ip4-and-include/)[ Foundational 5m What does the ‘null’ value mean in an SPF record? Jul 11, 2025 ](/blog/what-does-the-null-value-mean-in-an-spf-record/)[ Foundational 17m 10 Reasons The SPF Standard Is Essential For Protecting Your Domain Nov 20, 2025 ](/blog/10-reasons-the-spf-standard-is-essential-for-protecting-your-domain/)[ Foundational 4m 7 Myths and Misconceptions about Sender Policy Framework May 31, 2024 ](/blog/7-myths-and-misconceptions-about-sender-policy-framework/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Which IP addresses you should not add to your SPF records?","description":"The foremost step of creating an SPF record is enlisting all the IP addresses and mail servers that you want to add to it.","url":"https://autospf.com/blog/which-ip-addresses-you-should-not-add-to-your-spf-records/","datePublished":"2024-06-25T16:08:21.000Z","dateModified":"2026-04-18T02:36:41.000Z","dateCreated":"2024-06-25T16:08:21.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/which-ip-addresses-you-should-not-add-to-your-spf-records/"},"articleSection":"foundational","keywords":"SPF, SPF Flattening tool, SPF record","wordCount":706,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/images/2024/06/spf-lookup-2463.jpg","caption":"IP addresses","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Foundational","item":"https://autospf.com/foundational/"},{"@type":"ListItem","position":4,"name":"Which IP addresses you should not add to your SPF records?","item":"https://autospf.com/blog/which-ip-addresses-you-should-not-add-to-your-spf-records/"}]} ```