---
title: "SPF a, mx, ptr & ip4 Mechanisms Explained | AutoSPF"
description: "What the SPF a, mx, ptr, ip4/ip6 and exists mechanisms do, how many DNS lookups each costs, and why the ptr mechanism is deprecated and should be removed."
image: "https://autospf.com/images/og-default.png"
canonical: "https://autospf.com/spf-record-format/spf-a-mx-ptr-mechanisms/"
---

# SPF Mechanisms: a, mx, ptr, ip4 & exists

SPF mechanisms authorize senders: a matches a host's A/AAAA records, mx matches your MX hosts (and their addresses), ip4/ip6 list explicit addresses for zero DNS lookups, exists enables dynamic macro lookups, and ptr is deprecated and should be removed. Every mechanism except ip4/ip6 counts toward the 10-lookup limit.

This guide is part of our complete [SPF Record Syntax reference](/spf-record-format/). Related: [the include mechanism](/spf-record-format/spf-include-mechanism/) and [SoftFail vs HardFail vs Neutral](/spf-record-format/softfail-hardfail-neutral/).

An SPF record authorizes senders with **mechanisms** — the terms after `v=spf1` that each describe a set of permitted IP addresses. Four of them (`a`, `mx`, `ptr`, and the `ip4`/`ip6` pair) decide _which servers_ may send mail for your domain, and all but `ip4`/`ip6` cost you a DNS lookup against the RFC 7208 limit of 10\. Knowing exactly what each one resolves to — and which to avoid — is the difference between a record that passes cleanly and one that quietly drifts into `PermError`.

## The `a` mechanism

`a` authorizes the IP addresses in your domain’s **A (IPv4) and AAAA (IPv6) records**. Written bare, `a` matches the current domain; written as `a:mail.example.com`, it matches that host’s address records instead.

```
v=spf1 a a:mail.example.com -all
```

Use `a` when the same server that hosts your website also sends mail, or when a mail host publishes a stable A record you can point at. Each `a` term costs **one DNS lookup**, and an optional CIDR suffix (`a/24`) widens the match to a subnet — useful, but only when you genuinely control the whole range.

## The `mx` mechanism

`mx` authorizes every host listed in your domain’s **MX records** — the servers that _receive_ your mail, which for many small setups are also the servers that send it.

```
v=spf1 mx -all
```

`mx` is convenient because it tracks your mail hosts automatically: change an MX record and SPF follows. The catch is cost. `mx` resolves the MX records **and then the A/AAAA record of each mail host**, so a domain with five MX hosts can burn six or more lookups from a single `mx` term. On a busy record that’s often the first thing to trim.

## `ip4` and `ip6`: the only free mechanisms

`ip4` and `ip6` authorize explicit addresses or CIDR ranges and cost **zero DNS lookups**, because there is nothing to resolve — the address is already right there.

```
v=spf1 ip4:203.0.113.5 ip4:198.51.100.0/24 ip6:2001:db8::/32 -all
```

This is why [flattening an SPF record](/spf-flattening/how-to-flatten-an-spf-record/) — replacing lookup-heavy mechanisms with the `ip4`/`ip6` ranges they resolve to — keeps you under the limit. The trade-off is maintenance: hardcoded IPs go stale when a provider rotates addresses, so reserve them for senders whose IPs you own or that rarely change.

## The `ptr` mechanism — don’t use it

`ptr` matches when the sending IP’s **reverse DNS (PTR) record** resolves back to your domain. It sounds elegant and it is almost universally a mistake.

RFC 7208 explicitly discourages `ptr`: it is slow, it forces receivers to do extra reverse lookups, many receivers **skip or fail it outright**, and it depends on reverse DNS you frequently don’t control. The result is unreliable authentication and wasted lookups. If you have inherited a record containing `ptr`, replace it with the equivalent `a`, `mx`, or `ip4` terms and remove it. For the full reasoning, see our in-depth guide on [SPF mechanisms including a, mx and ip4](/blog/understanding-spf-mechanisms-a-mx-ip4-and-include/).

## The `exists` mechanism

`exists:%{ir}.spf.example.com` performs a single lookup and matches if that name resolves to any address. It is the building block behind [SPF macros](/spf-record-format/spf-macros/) and dynamic, per-message policies. Powerful, but advanced — most domains never need it, and it costs one lookup per term.

## Mechanism order and lookup budget

Receivers evaluate mechanisms **left to right** and stop at the first match, so put your most common senders first for speed. More importantly, every `a`, `mx`, `exists`, `include`, and `redirect` term counts toward the **10-lookup limit** — cross it and the whole record returns `PermError`, failing SPF for _every_ sender. Count your lookups with the [SPF Checker](/tools/spf-checker/) and, if you are close, delegate or flatten the heaviest mechanisms rather than adding more.

## Frequently Asked Questions

### Does the mx mechanism count as one DNS lookup?

No — `mx` counts as one lookup to fetch the MX records, plus an additional lookup for the A/AAAA record of _each_ mail host it returns. A domain with several MX hosts can consume five or more lookups from one `mx` term, which is why busy records often replace it with explicit `ip4` ranges.

### Should I use the ptr mechanism in my SPF record?

No. RFC 7208 discourages `ptr` because it is slow, unreliable, and often ignored or failed by receivers. Replace it with `a`, `mx`, or `ip4` mechanisms that authorize the same servers, and remove `ptr` entirely.

### What is the difference between the a and mx mechanisms?

`a` authorizes the IP addresses in a host’s A/AAAA records, while `mx` authorizes the servers listed in your MX records (then resolves each of their addresses). Use `a` for a specific known host; use `mx` when your receiving mail servers are also the ones that send.

### Do ip4 and ip6 mechanisms use a DNS lookup?

No. `ip4` and `ip6` list addresses directly, so there is nothing to resolve and they cost zero lookups. That makes them the safest way to stay under the 10-lookup limit — at the cost of manually updating them when a provider changes IPs.

Rated 5/5 on G2 · Trusted since 2018 

##  Trusted by 50,000+ domains 

### "AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product"

> It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF "flattens" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change. 

 PJ 

Peter J.

 President · Small-Business (50 or fewer emp.) 

### "Helped us go beyond capacity"

> AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example. 

 VU 

Verified User

 Financial Services · Mid-Market (51-1000 emp.) 

### "Great service and great support"

> AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup. 

 GF 

Greg F.

 Mid-Market (51-1000 emp.) 

[Read our reviews on G2 ](https://www.g2.com/products/autospf/reviews)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.facebook.com/autospf","https://github.com/duocircle","https://www.g2.com/products/autospf/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"5.0","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/autospf/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM","Email Deliverability","SPF Lookup Limits"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Does the mx mechanism count as one DNS lookup?","acceptedAnswer":{"@type":"Answer","text":"No — `mx` counts as one lookup to fetch the MX records, plus an additional lookup for the A/AAAA record of *each* mail host it returns. A domain with several MX hosts can consume five or more lookups from one `mx` term, which is why busy records often replace it with explicit `ip4` ranges."}},{"@type":"Question","name":"Should I use the ptr mechanism in my SPF record?","acceptedAnswer":{"@type":"Answer","text":"No. RFC 7208 discourages `ptr` because it is slow, unreliable, and often ignored or failed by receivers. Replace it with `a`, `mx`, or `ip4` mechanisms that authorize the same servers, and remove `ptr` entirely."}},{"@type":"Question","name":"What is the difference between the a and mx mechanisms?","acceptedAnswer":{"@type":"Answer","text":"`a` authorizes the IP addresses in a host's A/AAAA records, while `mx` authorizes the servers listed in your MX records (then resolves each of their addresses). Use `a` for a specific known host; use `mx` when your receiving mail servers are also the ones that send."}},{"@type":"Question","name":"Do ip4 and ip6 mechanisms use a DNS lookup?","acceptedAnswer":{"@type":"Answer","text":"No. `ip4` and `ip6` list addresses directly, so there is nothing to resolve and they cost zero lookups. That makes them the safest way to stay under the 10-lookup limit — at the cost of manually updating them when a provider changes IPs."}}]}
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"SPF Record Syntax","item":"https://autospf.com/spf-record-format/"},{"@type":"ListItem","position":3,"name":"a, mx & ptr Mechanisms","item":"https://autospf.com/spf-record-format/spf-a-mx-ptr-mechanisms/"}]}
```

```json
{"@context":"https://schema.org","@type":"Product","name":"AutoSPF","url":"https://autospf.com","aggregateRating":{"@type":"AggregateRating","ratingValue":5,"reviewCount":21,"bestRating":5,"worstRating":1},"review":[{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Peter J.","jobTitle":"President"},"datePublished":"2026-03-10","reviewBody":"It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF \"flattens\" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change.","name":"AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Verified User","jobTitle":"Financial Services"},"datePublished":"2025-07-31","reviewBody":"AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.","name":"Helped us go beyond capacity","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Greg F."},"datePublished":"2023-07-26","reviewBody":"AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup.","name":"Great service and great support","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}}]}
```