What is the difference between include: and redirect:?

Both include: and redirect= pull in another domain's SPF record, but they behave differently in ways that matter when something fails.

include: is the one most senders use. It imports the authorized IP ranges from another domain's SPF record into yours. Crucially, it's additive. Your domain's SPF record is still the controlling policy. If a message doesn't match anything in the included domain's record, evaluation continues through your remaining mechanisms. And your ~all or -all qualifier at the end still applies.

Example: v=spf1 include:mailchimp.com -all. This says: also authorize Mailchimp's sending IPs. Anything else fails hard.

redirect= is different. It completely hands SPF evaluation over to another domain. There's no additive inclusion. The target domain's SPF record becomes the entire policy for your domain. The receiving server stops evaluating your record and evaluates the redirect target's record instead, using that domain's all qualifier.

A few practical rules:

• You can only use one redirect= per SPF record
• If you use redirect=, you can't also use an all mechanism. The redirect takes over.
• Most regular senders never need redirect=. It's primarily used by large organizations managing SPF policies centrally across multiple domains

And the distinction matters because if you accidentally use redirect= when you meant include:, you've handed your entire SPF policy to another domain, including their catch-all qualifier. That's a significant configuration mistake.

In almost every case, include: is what you want. Use it to add your ESP's sending range to your domain's SPF record. If you're managing SPF across dozens of subdomains and want a centralized policy, check whether your ESP or DNS provider has better tooling for that before reaching for redirect=.

You can verify how your current SPF record evaluates with our free SPF checker.