a: SPF Mechanism

The SPF a mechanism authorises the IP addresses returned by a domain's A or AAAA record. Covers the /prefix-length and //ipv6-prefix forms, with complete example records.

Published · Last verified · Maintained by TamingDNS

Type
Mechanism
Syntax
a[:<domain>][/prefix-length][//ipv6-prefix]
DNS Lookup
Yes (counts toward 10-lookup limit)
Example
a:mail.example.com

💬 What This Mechanism Does

The "a" mechanism passes if the sending IP matches any A or AAAA record for the specified domain (defaulting to the sending domain if omitted). It's a convenient way to authorise a server you already use for your website or API without listing its IP directly.

When to Use This

  • Authorising a dedicated mail server whose IP matches its A record
  • Including a transactional server that shares your main domain's IP

⚠️ Watch Out For

  • Counts as one DNS lookup. If the domain has many A records, all are evaluated.
  • Avoid using bare "a" if your web server IP and mail server IP differ. It authorises the web IP too.

🔍 Prefix Lengths: /24 and //64

The syntax line above ends in [/prefix-length][//ipv6-prefix], and both parts are optional. A bare "a" authorises exactly the addresses the lookup returns. Add a prefix length and each of those addresses widens into a block around itself.

One slash sets the IPv4 prefix and two slashes set the IPv6 one, independently of each other. "a/24" widens every A record to its /24 and leaves the AAAA records matching a single address; "a//64" does the reverse; "a/24//64" does both. Leave either off and it falls back to a full-length match, which is /32 for IPv4 and /128 for IPv6.

The lookup cost is the same either way. "a/24" is one term against the 10-term limit exactly like bare "a", but it authorises 256 addresses instead of one. That makes it a cheap way to cover a sending range whose hosts shift around inside a block you control. A record that has run out of lookups can sometimes be brought back under the limit by widening one mechanism to cover what another was doing.

The ranges are 0 to 32 for IPv4 and 0 to 128 for IPv6, and a value outside them is a syntax error. Receivers validate the whole record before evaluating any of it, so one bad prefix length makes the entire record a permerror rather than skipping that one mechanism.

An "a/8" authorises 16.7 million addresses. Widen only to the block you control. A shorter record is not worth authorising a range you do not own.

📋 Complete Example Records

Every one of these is a complete record you can paste as it stands. Try one in the SPF Checker or build your own with the SPF Builder.

v=spf1 a -all

Bare "a" uses the sending domain itself. It matches AAAA records as well as A records, so an IPv6 sender on the same hostname passes too.

v=spf1 a:mail.example.com -all

This points at a named host instead of the domain, which is what you want when your website and your mail server are different machines.

v=spf1 a/24 -all

The prefix length widens each returned address to its /24. Still one DNS lookup, but now 256 IPv4 addresses are authorised rather than one.

v=spf1 a:mail.example.com/24//64 -all

The double slash sets the IPv6 prefix separately. Here the A records widen to /24 and the AAAA records to /64.

v=spf1 a mx -all

RFC 7208 §5.1 uses this example. Two terms, two lookups: the domain's own addresses plus the addresses of its MX hosts.

🔧 Related Tools

Check whether your current SPF record is valid and covers all your senders, or move on to the DKIM and DMARC side of the same job.

SPF Checker → SPF Builder → DMARC Analyser → DKIM Checker → Route 53 Splitter →
← All SPF syntax