mx — SPF Mechanism
The SPF mx mechanism authorises the IPs of your domain's MX records to send email. Learn when it helps and when it's risky.
Type
Mechanism
Mechanism
Syntax
mx[:<domain>][/prefix-length][//ipv6-prefix]
DNS Lookup
Yes — counts toward 10-lookup limit
Yes — counts toward 10-lookup limit
Example
mx
💬 What This Mechanism Does
The "mx" mechanism passes if the sending IP matches any A/AAAA record for any of the domain's MX hosts. It's shorthand for "the servers that receive my email are also allowed to send it" — which is often true for traditional on-premise mail servers but rarely true for cloud services.
When to Use This
- On-premise Exchange or Postfix setups where the same server sends and receives
- Small domains where the single MX host is also the outbound relay
⚠️ Watch Out For
- Counts as one DNS lookup for the MX query, plus one per MX host (up to 10 total).
- Modern cloud email (Microsoft 365, Google Workspace) uses different IPs for inbound (MX) vs. outbound — "mx" will NOT authorise cloud outbound senders.
- If you change your MX records, your SPF pass set changes silently.
📚 RFC References
🔗 Related SPF Elements
🔧 Validate Your SPF Record
Check whether your current SPF record is valid and covers all your senders.