ip4: SPF Mechanism
The SPF ip4 mechanism explicitly authorises an IPv4 address or CIDR range to send email. No DNS lookup required, the most efficient SPF mechanism.
Published · Last verified · Maintained by TamingDNS
Mechanism
ip4:<ip-address>[/prefix-length]
No (no extra lookup)
ip4:203.0.113.0/24
💬 What This Mechanism Does
The ip4 mechanism directly authorises an IPv4 address or CIDR subnet. It requires no DNS lookup, so it doesn't count against the 10-lookup limit. Use it for dedicated servers or static SMTP relay IPs that you control.
When to Use This
- A dedicated outbound SMTP relay with a static IP (ip4:198.51.100.5)
- An on-premise mail server subnet (ip4:192.0.2.0/24)
- A transactional email service that provides a fixed IP range
⚠️ Watch Out For
- Does not count toward the 10-lookup limit. Use ip4/ip6 over include where possible.
- Avoid ranges larger than /24 unless you genuinely own the whole subnet.
📋 Complete Example Records
Every one of these is a complete record you can paste as it stands. Try one in the SPF Checker or build your own with the SPF Builder.
v=spf1 ip4:192.0.2.10 -all
With no prefix given, RFC 7208 §5.6 treats an ip4 term as /32, so this authorises exactly that one host.
v=spf1 ip4:192.0.2.0/24 -all
Write the network address in full. 192.0.2.0/24 is valid; 192.0.2 is a syntax error and fails the entire record.
v=spf1 ip4:192.0.2.10 ip4:198.51.100.0/24 -all
You can list as many ip4 terms as you like. None of them cost a DNS lookup, so the ten-term limit is untouched.
v=spf1 include:_spf.google.com ip4:192.0.2.10 -all
Most domains end up somewhere near this: a cloud provider via include, plus your own relay or copier by address.
📚 RFC References
🔗 Related SPF Elements
🔧 Related Tools
Check whether your current SPF record is valid and covers all your senders, or move on to the DKIM and DMARC side of the same job.