Supposedly I have example.com domain and would like it to allow mails sent from subdomain.domain.com.

If the spf record should verify emails sent from *@subdomain.domain.com address (or mailed-by: subdomain.domain.com), would "v=spf1 a:domain.com ~all" allow the subdomain of domain.com too or only the domain.com?

I'm not sure if my question makes any sense, but would be glad to find an answer.


SPF works somewhat differently than you're trying to describe.

SPF records don't allow domains; they allow mail servers. When you put a:domain.com in an SPF record, that only means "accept mail from the IP address found at domain.com/A". If that actually points to your outgoing SMTP server, good. (In larger sites that wouldn't be the case.)

include:domain.com works in a similar way: instead of 'A' records, it does 'TXT' record lookups and imports domain.com's SPF policy. But that still boils down to "accept mail from those IP addresses that domain.com's SPF would have accepted".

So to answer the question, a: or include: won't include subdomains. That wouldn't make sense, and is actually impossible: there's no way for validators to know that a given IP address exists somewhere inside the domain.

SPF records themselves are found by looking up the sender's domain in DNS. For example, if the message has root@subdomain.example.com as its Envelope-From address, then SPF validators will search for a TXT record at subdomain.example.com – but they will not search the parent domain.

In other words, SPF policy specified at domain.com does not apply to messages sent by *@subdomain.example.com. If you want both domains to be protected by SPF, you should either copy or 'include' the policy explicitly, or use the 'redirect=' modifier.

  • You are right, it was a bit different in my head. This seems like a well-written complete answer (and more!) so marking this as answered. Useful as now I see how it works. In my example, example.com said "check domain.com for the range of IPs". subdomain.domain.com says the same thing, "check domain.com for the range of IPs". And there it was, the SPF/TXT record for with the IP ranges at domain.com – Savvas Radevic Jun 29 '18 at 22:24
  • 1
    I also mixed "a:" with "include:" in my question. So the example.com actually had "v=spf1 include:domain.com ~all", not "v=spf1 a:domain.com ~all" – Savvas Radevic Jun 29 '18 at 22:29
  • 1
    The answer to that isn't very different at all -- instead of taking IP addresses from 'A' records, it takes additional SPF policies from 'TXT' records at domain.com, but the logic is still the same and subdomains are not included. – grawity Jun 30 '18 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.