Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a quick question regarding SPF records: Do they need to be present for all subdomains?

Lets say that I have a TXT record with SPF info for

Let's also say that I have a seperate email domain for

Will the SPF policy/info for also apply to the subdomain? Or do I need to add a separate TXT record for that too?

share|improve this question
Note that you can have wildcard SPFs for subdomains: search wildcards below. – EML Feb 13 '15 at 16:30
up vote 31 down vote accepted

You need to have separate SPF records for each subdomain you wish to send mail from.

This makes sense - a subdomain may very well be in a different geographical location which will have a very different SPF definition.

EDIT - the 'include:' directive for SPF may be used to provide all subdomains with the same entries. For example, on the SPF record for subdomain enter ''. In this fashion whenever you update the definition for your subdomains will automatically pick up the updated values.

share|improve this answer
Agreed. Thanks! – Mike B Oct 19 '11 at 16:19

In addition to the other answers, if a subdomain is created as a CNAME record, the SPF record is the one for the domain it points to, e.g. is a CNAME of, the SPF a mailserver will get when it looks up is in the DNS record for This is the same in practice if the CNAME record says =>, so your TXT record would need to be othersub, not sub. This is in contrast to DKIM, which needs a separate TXT record for the public key, even if your subdomain is a CNAME.

share|improve this answer

No, but you can short-circuit them with the include:maindomain.invalid directive.

share|improve this answer
Can you elaborate on that? I'm curious... How would that directive work? – Mike B Oct 19 '11 at 17:55

But note, as it says in the FAQ referenced in the accepted answer, that you can have wildcard SPFs for a domain for wildcard A or MX records. I have wildcard MX domains, and this works for me:

* 3600 IN  TXT  "v=spf1 ip4:IPADDR -all"

with IPADDR replaced with your IP address/range.

share|improve this answer
* 3600 IN  TXT  "v=spf1 ip4:IPADDR -all" 

as written above does not work if the spammer uses a subdomain that is already in dDNS. For example A A records foresides the wildcard in that case.

share|improve this answer

Be aware that the include statement only includes A-records from the specified domain and not subdomains either. So it does not pick up A-records from subdomains and therefore it only works when all subdomains are on the same server or send from the same server.

share|improve this answer
I don't think this answer pertains to the question (which concerns SPF records, i.e. TXT) at all? – Felix Frank Jun 16 '14 at 11:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.