What are SPF mechanisms (e.g., ip4, a, mx, include)?

SPF mechanisms are the items inside an SPF record that define which servers are allowed to send email on behalf of your domain. When a receiving server evaluates your SPF record, it checks each mechanism left to right until it finds a match for the connecting IP address.

But Here's what each main mechanism does:

ip4: / ip6: The most direct mechanism. It authorizes a specific IP address or range. ip4:203.0.113.5 allows exactly that IP. ip4:203.0.113.0/24 allows the entire /24 subnet. Use this when you're sending from a known, fixed IP that isn't covered by other mechanisms.

a: Allows the IP addresses listed in your domain's A record (the record that maps your domain to an IP). Useful if you send email directly from your own web server.

mx: Allows the IP addresses from your domain's MX records. Useful if your incoming and outgoing mail share the same server infrastructure.

include:: The most commonly used mechanism for senders using an ESP. include:mailchimp.com tells receiving servers to also check Mailchimp's SPF record and treat those IPs as authorized too. Every ESP you use should have a corresponding include: statement in your SPF record. Each include: costs one DNS lookup, which matters for the 10-lookup limit.

all: This is the catch-all at the end of every SPF record. It applies to any connecting IP that didn't match anything earlier. The qualifier in front of it determines the outcome: ~all (soft fail, suspicious), -all (hard fail, reject), or ?all (neutral, no opinion). Almost every SPF record should end with either ~all or -all.

A real record using these mechanisms might look like:

v=spf1 ip4:203.0.113.5 include:mailchimp.com mx ~all

Mechanisms are evaluated left to right, and the first match wins. Order matters. If you want to understand advanced mechanisms like ptr and exists, they exist but are rarely needed in practice.