Home / server / Questions / 358620
Accepted
makerofthings7
Asked: 2012-02-10 18:01:21 +0800 CST

What takes precedence: an SPF record with "-all" in the primary TXT record, or one in the "include" section?

  • 772

Suppose I have a domain (company.com) with an SPF that looks like this:

v=spf1 ip4:70.70.70.70 include:host.marketing.com -all

and "host.marketing.com" looks like this

v=spf1 ip4:8.8.8.8 ~all

What takes precedence for company.com, the "~" or the "-"? Does the tilde in the marketing company's SPF negate all SPF benefit for company.com?

Is this behavior consistent among all SPF parsers?

email smtp spf

1 Answers

  1. Best Answer

    Assuming that all parsers adhere to the RFC4408 specification, the -all from the company.com record applies. The include does not modify the verification process, it merely expands it to include the mechanisms contained in the included record.

    If you were to use redirect in place of include, like this for company.com:

    v=spf1 ip4:70.70.70.70 redirect:host.marketing.com -all

    the ~all would apply, and -all would be discarded in the verification sequence. That is, again, assuming that all parsers adhere to the specification

    • 6