exists: SPF Mechanism
The SPF exists mechanism passes if a given domain resolves to any A record. Used with macros for dynamic per-IP whitelists.
Published · Last verified · Maintained by TamingDNS
Mechanism
exists:<domain>
Yes (counts toward 10-lookup limit)
exists:%{ir}.whitelist.example.com
💬 What This Mechanism Does
The exists mechanism passes if the specified domain resolves to at least one A record (any IP). By itself this is rarely useful, but combined with SPF macros (like %{i} for the sending IP or %{d} for the sending domain) it enables powerful dynamic lookups. For example, checking whether a specific IP is on a custom allowlist.
When to Use This
- Dynamic per-IP whitelists maintained as DNS zones
- Rate-limiting or geographic restrictions encoded in DNS
- Rare advanced use cases for large ESP infrastructure
⚠️ Watch Out For
- Counts as one DNS lookup.
- Requires SPF macro knowledge to be useful.
- Not widely understood. Document it carefully if you use it.
📋 Complete Example Records
Every one of these is a complete record you can paste as it stands. Try one in the SPF Checker or build your own with the SPF Builder.
v=spf1 exists:%{i}._spf.mta.salesforce.com -all
Salesforce publishes exactly this at _spf.salesforce.com. The sending IP becomes part of the hostname, so one term stands in for an allowlist Salesforce maintains as a DNS zone.
v=spf1 exists:%{ir}.%{v}._spf.%{d2} -all
From RFC 7208 §7.4. For a sender at 192.0.2.3 on example.com the lookup becomes 3.2.0.192.in-addr._spf.example.com: the reversed IP, then "in-addr", then your own domain.
v=spf1 exists:%{ir}.%{l1r+-}._spf.%{d} -all
RFC 7208 §5.7 gives this one. It folds the local-part of the sender in as well, so the decision can differ per mailbox as well as per IP.
v=spf1 include:_spf.google.com exists:%{ir}.allow.example.com -all
A cloud include comes first, then a dynamic fallback. Both cause DNS lookups, so this record has spent two of its ten.
📚 RFC References
🔗 Related SPF Elements
🔧 Related Tools
Check whether your current SPF record is valid and covers all your senders, or move on to the DKIM and DMARC side of the same job.