v=spf1 mx:example.org -all
-- sending host 192.0.2.140 passes
v=spf1 mx mx:example.org -all
-- sending hosts 192.0.2.129, 192.0.2.130, and 192.0.2.140 pass
v=spf1 mx/30 mx:example.org/30 -all
-- any sending host in 192.0.2.128/30 or 192.0.2.140/30 passes
v=spf1 ptr -all
-- sending host 192.0.2.65 passes (reverse DNS is valid and is in
example.com)
-- sending host 192.0.2.140 fails (reverse DNS is valid, but not
in example.com)
-- sending host 10.0.0.4 fails (reverse IP is not valid)
v=spf1 ip4:192.0.2.128/28 -all
-- sending host 192.0.2.65 fails
-- sending host 192.0.2.129 passes
B.2. Multiple Domain Example
These examples show the effect of related records:
example.org: "v=spf1 include:example.com include:example.net -all"
This record would be used if mail from example.org actually came
through servers at example.com and example.net. Example.org’s
designated servers are the union of example.com’s and example.net’s
designated servers.
la.example.org: "v=spf1 redirect=example.org"
ny.example.org: "v=spf1 redirect=example.org"
sf.example.org: "v=spf1 redirect=example.org"
These records allow a set of domains that all use the same mail
system to make use of that mail system’s record. In this way, only
the mail system’s record needs to be updated when the mail setup
changes. These domains’ records never have to change.
B.3. DNSBL Style Example
Imagine that, in addition to the domain records listed above, there
are these:
$ORIGIN _spf.example.com. mary.mobile-users A
127.0.0.2 fred.mobile-users A 127.0.0.2
15.15.168.192.joel.remote-users A 127.0.0.2
16.15.168.192.joel.remote-users A 127.0.0.2
The following records describe users at example.com who mail from
arbitrary servers, or who mail from personal servers.
example.com:
v=spf1 mx
include:mobile-users._spf.%{d}
include:remote-users._spf.%{d}
-all
mobile-users._spf.example.com:
v=spf1 exists:%{l1r+}.%{d}
remote-users._spf.example.com:
v=spf1 exists:%{ir}.%{l1r+}.%{d}
B.4. Multiple Requirements Example
Say that your sender policy requires both that the IP address is
within a certain range and that the reverse DNS for the IP matches.
This can be done several ways, including the following:
example.com. SPF ( "v=spf1 "
"-include:ip4._spf.%{d} "
"-include:ptr._spf.%{d} "
"+all" )
ip4._spf.example.com. SPF "v=spf1 -ip4:192.0.2.0/24 +all"
ptr._spf.example.com. SPF "v=spf1 -ptr +all"
This example shows how the "-include" mechanism can be useful, how an
SPF record that ends in "+all" can be very restrictive, and the use
of De Morgan’s Law.
Authors’ Addresses
Meng Weng Wong
Singapore
EMail: mengwong+spf@pobox.com
Wayne Schlitt
4615 Meredeth #9
Lincoln Nebraska, NE 68506
United States of America
EMail: wayne@schlitt.net
URI: http://www.schlitt.net/spf/
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).