- SPF records are single TXT records starting with v=spf1; any syntax error invalidates the entire record.
- Eight mechanisms exist: all, include, a, mx, ptr, ip4, ip6, exists; each either matches the client IP or not.
- Qualifiers (+,-,~,?) set the result when a mechanism matches; default is + (Pass).
- Modifiers like redirect= and exp= provide extra information; redirect= hands evaluation to another domain after all mechanisms fail.
- Macros (%{...}) expand dynamic values like sender or client IP, enabling per-IP authorization via exists.
- Evaluation is first-match-wins; order matters and mechanisms after all are ignored.
- DNS lookup limit is 10 (include, a, mx, ptr, exists, redirect count); ip4, ip6, all, exp are exempt.
- Common mistakes: using ipv4 instead of ip4, spaces after colons, multiple SPF records, terms after all.
- Long records (over 255 characters) must be split into multiple quoted strings in one TXT record, concatenated without spaces.
- Practical recommendations: use -all for strict policies, ~all for discovery, and avoid ptr and macro letters that break caching.