SPF Mechanisms: a, mx, ptr, ip4 & exists
SPF mechanisms authorize senders: a matches a host's A/AAAA records, mx matches your MX hosts (and their addresses), ip4/ip6 list explicit addresses for zero DNS lookups, exists enables dynamic macro lookups, and ptr is deprecated and should be removed. Every mechanism except ip4/ip6 counts toward the 10-lookup limit.
This guide is part of our complete SPF Record Syntax reference. Related: the include mechanism and SoftFail vs HardFail vs Neutral.
An SPF record authorizes senders with mechanisms — the terms after v=spf1 that each describe a set of permitted IP addresses. Four of them (a, mx, ptr, and the ip4/ip6 pair) decide which servers may send mail for your domain, and all but ip4/ip6 cost you a DNS lookup against the RFC 7208 limit of 10. Knowing exactly what each one resolves to — and which to avoid — is the difference between a record that passes cleanly and one that quietly drifts into PermError.
The a mechanism
a authorizes the IP addresses in your domain’s A (IPv4) and AAAA (IPv6) records. Written bare, a matches the current domain; written as a:mail.example.com, it matches that host’s address records instead.
v=spf1 a a:mail.example.com -allUse a when the same server that hosts your website also sends mail, or when a mail host publishes a stable A record you can point at. Each a term costs one DNS lookup, and an optional CIDR suffix (a/24) widens the match to a subnet — useful, but only when you genuinely control the whole range.
The mx mechanism
mx authorizes every host listed in your domain’s MX records — the servers that receive your mail, which for many small setups are also the servers that send it.
v=spf1 mx -allmx is convenient because it tracks your mail hosts automatically: change an MX record and SPF follows. The catch is cost. mx resolves the MX records and then the A/AAAA record of each mail host, so a domain with five MX hosts can burn six or more lookups from a single mx term. On a busy record that’s often the first thing to trim.
ip4 and ip6: the only free mechanisms
ip4 and ip6 authorize explicit addresses or CIDR ranges and cost zero DNS lookups, because there is nothing to resolve — the address is already right there.
v=spf1 ip4:203.0.113.5 ip4:198.51.100.0/24 ip6:2001:db8::/32 -allThis is why flattening an SPF record — replacing lookup-heavy mechanisms with the ip4/ip6 ranges they resolve to — keeps you under the limit. The trade-off is maintenance: hardcoded IPs go stale when a provider rotates addresses, so reserve them for senders whose IPs you own or that rarely change.
The ptr mechanism — don’t use it
ptr matches when the sending IP’s reverse DNS (PTR) record resolves back to your domain. It sounds elegant and it is almost universally a mistake.
RFC 7208 explicitly discourages ptr: it is slow, it forces receivers to do extra reverse lookups, many receivers skip or fail it outright, and it depends on reverse DNS you frequently don’t control. The result is unreliable authentication and wasted lookups. If you have inherited a record containing ptr, replace it with the equivalent a, mx, or ip4 terms and remove it. For the full reasoning, see our in-depth guide on SPF mechanisms including a, mx and ip4.
The exists mechanism
exists:%{ir}.spf.example.com performs a single lookup and matches if that name resolves to any address. It is the building block behind SPF macros and dynamic, per-message policies. Powerful, but advanced — most domains never need it, and it costs one lookup per term.
Mechanism order and lookup budget
Receivers evaluate mechanisms left to right and stop at the first match, so put your most common senders first for speed. More importantly, every a, mx, exists, include, and redirect term counts toward the 10-lookup limit — cross it and the whole record returns PermError, failing SPF for every sender. Count your lookups with the SPF Checker and, if you are close, delegate or flatten the heaviest mechanisms rather than adding more.
Frequently Asked Questions
Does the mx mechanism count as one DNS lookup?
No — mx counts as one lookup to fetch the MX records, plus an additional lookup for the A/AAAA record of each mail host it returns. A domain with several MX hosts can consume five or more lookups from one mx term, which is why busy records often replace it with explicit ip4 ranges.
Should I use the ptr mechanism in my SPF record?
No. RFC 7208 discourages ptr because it is slow, unreliable, and often ignored or failed by receivers. Replace it with a, mx, or ip4 mechanisms that authorize the same servers, and remove ptr entirely.
What is the difference between the a and mx mechanisms?
a authorizes the IP addresses in a host’s A/AAAA records, while mx authorizes the servers listed in your MX records (then resolves each of their addresses). Use a for a specific known host; use mx when your receiving mail servers are also the ones that send.
Do ip4 and ip6 mechanisms use a DNS lookup?
No. ip4 and ip6 list addresses directly, so there is nothing to resolve and they cost zero lookups. That makes them the safest way to stay under the 10-lookup limit — at the cost of manually updating them when a provider changes IPs.