ip6: SPF Mechanism
The SPF ip6 mechanism explicitly authorises an IPv6 address or prefix to send email. No DNS lookup required.
Published · Last verified · Maintained by TamingDNS
Mechanism
ip6:<ip6-address>[/prefix-length]
No (no extra lookup)
ip6:2001:db8::/32
💬 What This Mechanism Does
The ip6 mechanism works identically to ip4 but for IPv6 addresses. As more servers send from IPv6, omitting ip6: entries means those senders will fail SPF silently.
When to Use This
- Authorising an IPv6-addressed outbound mail server
- Including an IPv6 prefix for a cloud provider's sending range
⚠️ Watch Out For
- Does not count toward the 10-lookup limit.
- Use CIDR notation carefully. IPv6 prefixes can accidentally cover enormous ranges.
📋 Complete Example Records
Every one of these is a complete record you can paste as it stands. Try one in the SPF Checker or build your own with the SPF Builder.
v=spf1 ip6:2001:db8::1 -all
With no prefix, RFC 7208 §5.6 reads an ip6 term as /128, so this is a single host.
v=spf1 ip6:2001:db8::/32 -all
A /32 in IPv6 is not the /32 you know from IPv4. This one covers 2^96 addresses, so check the prefix your provider gave you.
v=spf1 ip4:192.0.2.0/24 ip6:2001:db8::/48 -all
An ip4 term can never match a connection arriving over IPv6, so a server reachable both ways needs both entries.
v=spf1 include:_spf.google.com ip6:2001:db8::/48 -all
A cloud include alongside your own IPv6 relay. If mail fails SPF only from some networks, a missing ip6 term is worth ruling out.
📚 RFC References
🔗 Related SPF Elements
🔧 Related Tools
Check whether your current SPF record is valid and covers all your senders, or move on to the DKIM and DMARC side of the same job.