Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just want to clarify the +a part of an SPF record since I have an idea how this works but I am unsure.

spf record for

v=spf1 +a -all

My current understanding is that if there is a valid a record for the server it will be accepted.

For example:

A: 123.456.789.12

the IP address above would be a valid sender for because of +a.

However I am unsure about sub-domains and how this works.

A: 123.456.789.13
A: 123.456.789.14

Would these IP addresses also be allowed to send as because of the +a part of the SPF record?

Thank you

share|improve this question
It looks like v=spf1 a -all is the same as v=spf1 -all. So because of this I would need to add seporate records for and – dgibbs Apr 22 '13 at 16:24
please don't use 123.456.789.012 when making up A-records, it is not a possible IP address(456 and 789 > 255) and makes it hard to answer your question with a good example – Gryphius Apr 22 '13 at 16:34
Is truly a subdomain name and not just an A record (host) on – TheCleaner Apr 22 '13 at 16:52
It is just an a record for pointing at a different IP address – dgibbs Apr 22 '13 at 22:13

a would only include the a record(s) of, unless you explicitely specify a hostname if your servers all have ips in the same subnet you could for example specify a/24 which would include's A record and all ips in the same /24


share|improve this answer
Thanks for the answer. Do you have any examples of records that a might cover other than just As far as I can tell a only covers the a record for – dgibbs Apr 22 '13 at 22:22

To give a valid example of how to use the a-mechanism with an FQDN other than the current SPF record, here is a few options:

a mechanism with a domain name as argument (and how it expands):

v=spf1 -all
v=spf1 123.456.789.13         123.456.789.14         -all

a mechanism with a CIDR prefix as argument (and how it expands):

v=spf1 a/24              -all
v=spf1 123.456.789.12/24 -all

You can either use a specific FQDN to lookup ( and then trust the registered IP address(es) for that host, or you can perform a lookup on the current FQDN - that is, the domain name for which we are currently performing the SPF check for. You can then add a prefix to specify an entire network segment around the resulting IP address(es).

Both of the above examples will work for you domain, given the details in your question, but I would recommend the first option.

One more thing:

a is the same as +a

The + qualifier is the default qualifier, no need for that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.