redirect: SPF Modifier
The SPF redirect modifier replaces your SPF record with another domain's record entirely. Learn how it differs from include and when to use it.
Published · Last verified · Maintained by TamingDNS
Modifier
redirect=<domain>
Yes (counts toward 10-lookup limit)
redirect=_spf.example.com
💬 What This Modifier Does
The redirect modifier completely replaces the current SPF evaluation with the SPF record of another domain. Unlike "include", it is not a mechanism. It's evaluated last and only if no earlier mechanism matched. It's useful for shared hosting environments or organisations that maintain one canonical SPF record referenced by many domains.
When to Use This
- A parent domain that maintains the authoritative SPF for all company subdomains
- Hosted email where the provider maintains the SPF and you reference it
⚠️ Watch Out For
- Cannot be combined with "all". If "all" appears in the record, redirect is ignored.
- Counts as one DNS lookup.
- Unlike include, if the target domain has no SPF record the result is "permerror".
- The entire SPF check transfers to the target domain, including its final "all" qualifier.
📋 Complete Example Records
Every one of these is a complete record you can paste as it stands. Try one in the SPF Checker or build your own with the SPF Builder.
v=spf1 redirect=_spf.example.com
That is the whole record. It carries no "all" of its own, because the target's policy is the one that applies.
la.example.com. TXT "v=spf1 redirect=_spf.example.com" ny.example.com. TXT "v=spf1 redirect=_spf.example.com" _spf.example.com. TXT "v=spf1 mx:example.com -all"
The pattern RFC 7208 §6.1 shows: several domains under one administration pointing at a single record, which is then the only place you edit.
v=spf1 mx redirect=_spf.example.com
Mechanisms run first. The redirect only happens if none of them matched, so your own MX hosts are checked before the shared record.
v=spf1 redirect=_spf.example.com -all
An "all" anywhere in the record means the redirect MUST be ignored, so this one authorises nothing and hard-fails everyone.
📚 RFC References
🔗 Related SPF Elements
🔧 Related Tools
Check whether your current SPF record is valid and covers all your senders, or move on to the DKIM and DMARC side of the same job.