SPF Macros Explained
SPF macros are %{letter} placeholders a receiver expands at check time — using the message's sender, domain, or IP — to build a dynamic DNS lookup, usually inside an exists mechanism. They let large senders authorize thousands of senders with one term and stay under the 10-lookup limit, but they are advanced and unnecessary for most domains.
This guide is part of our complete SPF Record Syntax reference. Related: the redirect modifier and a, mx & ptr mechanisms.
SPF macros are the advanced corner of the syntax: placeholder variables that a receiver expands at check time, using details of the message being evaluated, before it performs a DNS lookup. They let one compact SPF term authorize senders dynamically instead of listing every IP in advance. Almost no small domain needs them — but for large senders, ESPs, and multi-tenant platforms they solve problems no static record can.
What an SPF macro looks like
A macro is a %{letter} token embedded in a mechanism’s domain, most often inside an exists mechanism:
v=spf1 exists:%{ir}.%{d}.spf.example.com -allWhen a message arrives, the receiver substitutes real values and queries the resulting name. The common macro letters are:
| Macro | Expands to |
|---|---|
%{s} | the full MAIL FROM sender (user@domain) |
%{l} | the local part of the sender (before the @) |
%{d} | the sender’s domain |
%{i} | the sending IP address |
%{ir} | the sending IP, reversed (for building lookup names) |
%{h} | the HELO/EHLO hostname |
%{v} | the literal in-addr (IPv4) or ip6 |
A trailing digit truncates to that many right-hand labels, and an r reverses order — so %{d2} is the last two labels of the domain and %{ir} is the IP reversed for in-addr-style lookups.
Why you would use a macro
The point of a macro is one record that answers per-sender questions dynamically:
- Per-user or per-IP authorization. A platform sending on behalf of thousands of customers can encode the sender’s IP or domain into a lookup (
exists:%{ir}.%{d}._spf.provider.net) and answer “is this specific IP allowed for this specific sender?” without listing every combination. - Staying under the 10-lookup limit at scale. Because a macro resolves to a single
existslookup regardless of how many senders it covers, it can replace dozens ofincludeterms that would otherwise blow the lookup budget. - Delegating decisions to a smart DNS backend. The authoritative server for the macro domain can compute pass/fail on the fly.
Why macros are rare (and risky)
Macros are powerful but come with real caveats, which is why the vast majority of records never use them:
- Support is uneven. Every compliant receiver should evaluate macros per RFC 7208, but the feature is complex and edge cases exist. Test thoroughly before relying on it.
- They are hard to read and debug. A macro record is opaque to anyone auditing your DNS, and a mistake fails silently.
- They need a DNS backend that understands them.
existsmacros are only useful if something on the other end returns the right answer — usually your ESP’s infrastructure, not a plain zone file.
For most domains, a well-structured record using include, ip4, and — where needed — SPF flattening is simpler, safer, and just as effective. Reach for macros only when you are operating at a scale where static records genuinely cannot keep up. For a longer walk-through with more examples, see our detailed guide on SPF macros.
Frequently Asked Questions
What are SPF macros used for?
SPF macros let a receiver expand variables — like the sender’s IP (%{i}), domain (%{d}), or reversed IP (%{ir}) — at check time to build a dynamic DNS lookup. They are used by large senders and ESPs to authorize thousands of senders with a single exists term instead of listing every IP, keeping the record small and under the 10-lookup limit.
Do I need SPF macros for a normal domain?
No. Almost no ordinary domain needs macros. A standard record using include, ip4, and -all covers the vast majority of setups. Macros only pay off at large scale — multi-tenant platforms or ESPs where static records can’t keep up with the number of senders.
Are SPF macros supported by all mail servers?
Compliant receivers should evaluate macros per RFC 7208, but support is uneven and the feature is complex enough that edge cases exist. Test against your real recipients before depending on a macro-based record, and keep a simpler fallback in mind.
What does %{ir} mean in an SPF macro?
%{ir} expands to the sending IP address with its octets reversed, the form used to build in-addr-style DNS lookup names. It commonly appears in exists:%{ir}.%{d}._spf.example.com constructions that ask a DNS backend whether a specific IP is authorized for a specific domain.