ptr: SPF Mechanism
The SPF ptr mechanism authorises senders via reverse DNS lookup. RFC 7208 explicitly recommends against using it. Learn why and what to use instead.
Published · Last verified · Maintained by TamingDNS
Mechanism
ptr[:<domain>]
Yes (counts toward 10-lookup limit)
ptr:example.com
💬 What This Mechanism Does
The ptr mechanism passes if a reverse DNS (PTR) lookup on the sending IP returns a hostname that resolves back to an IP in the sending domain. This is the Forward-Confirmed Reverse DNS (FCrDNS) check. While conceptually sound, it's slow, unreliable, and explicitly deprecated by RFC 7208.
When to Use This
- Legacy records only, no new use cases recommended.
⚠️ Watch Out For
- RFC 7208 §5.5 states: "use of this mechanism is discouraged."
- PTR lookups are slow, can time out, and some nameservers don't support them.
- One term against the 10-term limit. There's also a second cap inside the mechanism: evaluating the PTR records must not query more than 10 address records. Everything past the first 10 is ignored, and unlike "mx" that produces no permerror to warn you (RFC 7208 §4.6.4).
- Results are unreliable. Many hosting providers don't set reverse DNS.
- Replace with ip4/ip6 or a/mx for equivalent authorisation.
📋 Complete Example Records
Every one of these is a complete record you can paste as it stands. Try one in the SPF Checker or build your own with the SPF Builder.
v=spf1 ptr -all
This is the bare legacy form. It matches when the sender's reverse DNS validates back to your own domain, and RFC 7208 §5.5 says it SHOULD NOT be published.
v=spf1 ptr:example.com -all
Matches a validated name that is example.com or a subdomain of it. So mail.example.com matches; mail.bad-example.com does not.
v=spf1 mx ptr -all
If a legacy record still carries ptr, keep it last. The RFC asks for that because the mechanism is slow and leans on the .arpa nameservers.
v=spf1 a:mail.example.com ip4:192.0.2.0/24 -all
This is what replaces ptr. Name the hosts and addresses directly and the answer no longer depends on reverse DNS you may not control.
📚 RFC References
🔗 Related SPF Elements
🔧 Related Tools
Check whether your current SPF record is valid and covers all your senders, or move on to the DKIM and DMARC side of the same job.