Understanding the IP4 and IP6 Mechanisms in SPF
The ip4 and ip6 mechanisms in a Sender Policy Framework (SPF) record define the exact IPv4 and IPv6 addresses or subnets permitted to send email on behalf of your domain. Without explicitly declaring these network ranges, legitimate messages originating from your infrastructure may fail authentication checks and end up in spam folders.
Properly configuring these mechanisms ensures receiving mail servers can cryptographically verify that your outgoing servers are authorized. By combining precise host addresses and CIDR notations, you establish a solid perimeter around your corporate email flow.
To build your records effortlessly without manual syntax errors, you can use the SPF Record Generator tool on XiaTools to quickly assemble and validate your IPv4 and IPv6 directives.
The Anatomy of SPF IP Mechanisms
An SPF record is a DNS TXT record starting with v=spf1 followed by a sequence of mechanisms and qualifiers. The ip4 and ip6 mechanisms instruct the receiving server to compare the connecting IP address of the incoming mail server against the specified addresses or network blocks.
Syntax Rules
When writing an SPF record, the syntax is straightforward. You specify the mechanism name followed by a colon and the IP address or CIDR network block.
ip4:192.0.2.1ip4:192.0.2.0/24ip6:2001:db8::1ip6:2001:db8::/32
If you do not append an explicit qualifier, the default + (Pass) qualifier is applied automatically. This means if the connecting mail server's IP matches the entry, the SPF check succeeds.
IPv4 Mechanism (ip4) Configuration
The ip4 mechanism handles traditional 32-bit Internet Protocol addresses. You can target a single host or an entire subnet using CIDR notation.
Single Host vs. CIDR Blocks
If your mail server has a static, dedicated IP address like 192.0.2.25, you authorize it directly:
v=spf1 ip4:192.0.2.25 -all
If your organization utilizes a block of IPs provided by your hosting provider, such as 192.0.2.0 through 192.0.2.255, you use the /24 CIDR prefix to cover all 256 addresses cleanly:
v=spf1 ip4:192.0.2.0/24 -all
IPv6 Mechanism (ip6) Configuration
The ip6 mechanism manages 128-bit IPv6 addresses. As modern mail transfer agents (MTAs) increasingly default to IPv6 connections when available, omitting your IPv6 infrastructure from your SPF record will cause delivery failures.
IPv6 Syntax and Subnets
Similar to IPv4, you can specify individual IPv6 addresses or network ranges using standard colon-hexadecimal notation and prefix lengths.
v=spf1 ip4:192.0.2.10 ip6:2001:db8::1234 -all
For a larger subnet allocation assigned to your data center, apply the appropriate prefix length:
v=spf1 ip6:2001:db8:1234::/48 -all
Comparing IP Mechanisms
| Feature | ip4 Mechanism |
ip6 Mechanism |
|---|---|---|
| Address Length | 32 bits | 128 bits |
| Notation Example | 192.0.2.0/24 |
2001:db8::/32 |
| Lookup Consumption | Zero DNS lookups | Zero DNS lookups |
| Failure Impact | Blocks matching IPv4 spoofing | Blocks matching IPv6 spoofing |
Step-by-Step Implementation Guide
Implementing these mechanisms requires auditing your infrastructure and updating your DNS configuration.
Step 1: Inventory Your Outgoing Mail Servers
List every server, application, and cloud service that sends email using your domain name. Identify their static IPv4 and IPv6 addresses.
Step 2: Determine Subnet Boundaries
If your servers reside on cloud provider networks or enterprise data centers, check your network administration panel or hosting documentation to find the exact CIDR blocks assigned to your outgoing mail relays.
Step 3: Construct the TXT Record
Combine your addresses into a single valid string. Remember that an SPF record must not exceed 512 bytes to avoid truncation over UDP DNS queries.
v=spf1 ip4:192.0.2.1 ip4:192.0.2.0/24 ip6:2001:db8::1 -all
Step 4: Add the Record to Your DNS Provider
Log in to your DNS hosting provider's management console. Navigate to the zone file editor. Name your record @ (or leave it blank for the root domain), select TXT as the record type, paste your string, and save.
Verification and Troubleshooting
After publishing your changes, verify that your record resolves correctly and that mail servers interpret your ip4 and ip6 entries without error.
Using Dig to Check DNS
Run a standard DNS query from your terminal to inspect the deployed record:
dig example.com TXT
Expected output sample:
;; ANSWER SECTION:
example.com. 300 IN TXT "v=spf1 ip4:192.0.2.1 ip6:2001:db8::1 -all"
Testing with PowerShell
On Windows systems, you can query your domain using PowerShell:
Resolve-DnsName -Name example.com -Type TXT
Simulating SPF Validation
To ensure your mail server's public IP matches your declared rules, you can check your external connectivity using curl:
curl -4 ifconfig.me
curl -6 ifconfig.me
Common Mistakes and How to Fix Them
- Exceeding DNS Lookup Limits: While
ip4andip6mechanisms do not count against the 10-lookup limit imposed by the SPF specification, nesting too manyincludemechanisms to find IPs will cause failures. Consolidate static server IPs directly usingip4andip6where possible. - Using Incorrect CIDR Prefixes: A typo in a subnet mask like
/32instead of/24can inadvertently exclude legitimate sending servers. Always double-check your network math. - Forgetting IPv6: Neglecting to add your IPv6 range means that when your mail server sends mail over an IPv6 connection, receiving servers evaluate your SPF record against only your IPv4 rules, leading to authentication failures.
- Multiple SPF Records: Publishing more than one SPF record for a single domain violates the RFC specification and causes unpredictable validation results by receiving mail transfer agents.