a: SPF Mechanism
The SPF a mechanism authorises the IP addresses returned by a domain's A or AAAA record. Covers the /prefix-length and //ipv6-prefix forms, with complete example records.
Published · Last verified · Maintained by TamingDNS
Mechanism
a[:<domain>][/prefix-length][//ipv6-prefix]
Yes (counts toward 10-lookup limit)
a:mail.example.com
💬 What This Mechanism Does
The "a" mechanism passes if the sending IP matches any A or AAAA record for the specified domain (defaulting to the sending domain if omitted). It's a convenient way to authorise a server you already use for your website or API without listing its IP directly.
When to Use This
- Authorising a dedicated mail server whose IP matches its A record
- Including a transactional server that shares your main domain's IP
⚠️ Watch Out For
- Counts as one DNS lookup. If the domain has many A records, all are evaluated.
- Avoid using bare "a" if your web server IP and mail server IP differ. It authorises the web IP too.
🔍 Prefix Lengths: /24 and //64
The syntax line above ends in [/prefix-length][//ipv6-prefix], and both parts are optional. A bare "a" authorises exactly the addresses the lookup returns. Add a prefix length and each of those addresses widens into a block around itself.
One slash sets the IPv4 prefix and two slashes set the IPv6 one, independently of each other. "a/24" widens every A record to its /24 and leaves the AAAA records matching a single address; "a//64" does the reverse; "a/24//64" does both. Leave either off and it falls back to a full-length match, which is /32 for IPv4 and /128 for IPv6.
The lookup cost is the same either way. "a/24" is one term against the 10-term limit exactly like bare "a", but it authorises 256 addresses instead of one. That makes it a cheap way to cover a sending range whose hosts shift around inside a block you control. A record that has run out of lookups can sometimes be brought back under the limit by widening one mechanism to cover what another was doing.
The ranges are 0 to 32 for IPv4 and 0 to 128 for IPv6, and a value outside them is a syntax error. Receivers validate the whole record before evaluating any of it, so one bad prefix length makes the entire record a permerror rather than skipping that one mechanism.
An "a/8" authorises 16.7 million addresses. Widen only to the block you control. A shorter record is not worth authorising a range you do not own.
📋 Complete Example Records
Every one of these is a complete record you can paste as it stands. Try one in the SPF Checker or build your own with the SPF Builder.
v=spf1 a -all
Bare "a" uses the sending domain itself. It matches AAAA records as well as A records, so an IPv6 sender on the same hostname passes too.
v=spf1 a:mail.example.com -all
This points at a named host instead of the domain, which is what you want when your website and your mail server are different machines.
v=spf1 a/24 -all
The prefix length widens each returned address to its /24. Still one DNS lookup, but now 256 IPv4 addresses are authorised rather than one.
v=spf1 a:mail.example.com/24//64 -all
The double slash sets the IPv6 prefix separately. Here the A records widen to /24 and the AAAA records to /64.
v=spf1 a mx -all
RFC 7208 §5.1 uses this example. Two terms, two lookups: the domain's own addresses plus the addresses of its MX hosts.
📚 RFC References
🔗 Related SPF Elements
🔧 Related Tools
Check whether your current SPF record is valid and covers all your senders, or move on to the DKIM and DMARC side of the same job.