Deep Dive into SPF Mechanisms: all, ip4, and include

Sender Policy Framework (SPF) records are simple TXT records in your DNS configurations. However, understanding the specific mechanisms and qualifiers (like +ip4, include, and ~all) is vital to configure your email security accurately.

1. The IP Mechanisms: ip4 and ip6

The ip4 and ip6 mechanisms explicitly list IP ranges authorized to send mail. For example, ip4:192.0.2.1/24 authorizes any mail server within that specific IP subnet to send emails on behalf of your domain.

2. The include Mechanism

The include mechanism authorizes third-party services (like Google Workspace or SendGrid) to send emails by referencing their SPF configurations. For example, include:_spf.google.com tells recipient servers to trust the IPs listed in Google's SPF records.

3. The fallback Qualifier: all

The all mechanism defines how to handle servers not explicitly listed. The prefix qualifier is key: -all (Hard Fail) instructs recipient servers to reject non-authorized emails, while ~all (Soft Fail) suggests quarantining or flagging them as suspicious, securing your deliverability.