How to Read SPF Syntax
An SPF record lives in a DNS TXT record at your root domain (@). Common mechanisms include:
- include:_spf.google.com: Delegates authorization to Google's mail servers.
- ip4:192.0.2.1/24: Directly authorizes an IPv4 address block without consuming a DNS query.
- ~all (Softfail): Untrusted servers are accepted but marked as suspicious.
- -all (Hardfail): Untrusted servers are strictly rejected. Recommended for strong anti-spoofing.