What does the SPF mx Mechanism do?

`mx`: SPF Mechanism

The SPF mx mechanism authorises the IPs of your domain's MX records to send email. Learn when it helps and when it's risky.

Published May 10, 2026 · Last verified August 7, 2026 · Maintained by TamingDNS

Type
Mechanism

Syntax
mx[:<domain>][/prefix-length][//ipv6-prefix]

DNS Lookup
Yes (counts toward 10-lookup limit)

Example
mx

💬 What This Mechanism Does

The "mx" mechanism passes if the sending IP matches any A/AAAA record for any of the domain's MX hosts. It's shorthand for "the servers that receive my email are also allowed to send it", which is often true for traditional on-premise mail servers but rarely true for cloud services.

When to Use This

On-premise Exchange or Postfix setups where the same server sends and receives
Small domains where the single MX host is also the outbound relay

⚠️ Watch Out For

One term against the 10-term DNS lookup limit, however many MX hosts you have. The per-host A/AAAA lookups don't touch that budget.
There's a second cap inside the mechanism itself: evaluating your MX records must not query more than 10 address records. Go over and "mx" returns permerror (RFC 7208 §4.6.4).
Modern cloud email (Microsoft 365, Google Workspace) uses different IPs for inbound (MX) vs. outbound. "mx" will NOT authorise cloud outbound senders.
If you change your MX records, your SPF pass set changes silently.

📋 Complete Example Records

Every one of these is a complete record you can paste as it stands. Try one in the SPF Checker or build your own with the SPF Builder.

v=spf1 mx -all

This is the classic on-premise record: whichever servers receive your mail are also allowed to send it. One term, however many MX hosts you have.

v=spf1 mx:example.com -all

It authorises another domain's MX hosts, which helps when a parent domain owns the mail servers and a subdomain wants the same set.

v=spf1 mx a:relay.example.com -all

Inbound servers plus a separate outbound relay cost two terms against the ten-term budget, and the relay does not need to appear in your MX records.

v=spf1 mx/24 -all

Each MX host address widens to its /24. Reach for this only when you own the surrounding subnet.

v=spf1 mx include:spf.protection.outlook.com -all

A Microsoft 365 migration usually lands here. "mx" now points at Microsoft's inbound servers, which do not send outbound mail, so the include is what authorises anything.