Why do sub-domain SPF records behave differently?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
If you're sending marketing emails from marketing.yourdomain.com and you only have an SPF record on yourdomain.com, those marketing emails will fail SPF. Subdomains don't inherit anything from the parent domain.
That's the key thing that surprises people: DNS doesn't work by inheritance for SPF. Each subdomain is its own DNS namespace. When a receiving server checks SPF for a message sent from captain@mail.deepcurrent.io, it looks up the SPF record at mail.deepcurrent.io, not at deepcurrent.io. If there's nothing at mail.deepcurrent.io, SPF returns "none," which is treated as a failure by many servers.
This matters practically in a few situations:
- Your ESP sends on a subdomain (common for marketing senders, like
em.yourdomain.com). That subdomain needs its own SPF record, usually set up by the ESP during onboarding. - You send transactional email from a different subdomain than your regular email. Each needs its own record.
- You set up a new subdomain for a new product or service and forget to configure SPF before sending from it.
The one exception: redirect= in an SPF record hands evaluation entirely to another domain, which can be used as a way to manage subdomain SPF centrally. But it's not inheritance, it's an explicit redirect. Each subdomain still needs to declare it.
If you're not sure which subdomains you're sending from or whether they have SPF records, our free SPF checker can validate any subdomain directly. You can also check what a correctly formatted record looks like and where to publish it for each subdomain you control.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
