Part of my SPF record contains:


I'm still getting soft fail because the actual e-mail is delivered by the following

Received: from mail-yx0-f172.google.com (mail-yx0-f172.google.com []

Which has a completely different IP from google.com. However I don't want to put in mail-yx0-f172.google.com because it might be dynamic. Is there some equivalent of *.google.com that I can use in the record


No you can't. That is not the correct SPF record, and it is not the correct address of Google's SPF record. Anyone with the control of a reverse DNS domain can make any IP have any name he/she wants, like "google.com", "whitehouse.gov", etc. Allowing reverse matches at all would be very wrong.

The "include" feature of SPF works differently. It does a direct DNS resolution on the given name, and then processes the records that comes from that response. The correct SPF record for Google's e-mail servers is:

v=spf1 include:_spf.google.com ~all

The match is done by IP address from the results returned by a TXT DNS query to _spf.google.com. Should Google ever change the IP address of their mail servers, this record should be changed too. As of today, a query to that record returns:

~% dig +short txt _spf.google.com
"v=spf1 ip4: ip4: ip4:
ip4: ip4: ip4: ip4:
ip4: ip4: ip4: ?all"

Note that the address you are seeing,, is included above, in So, if your SPF record is configured correctly, it should PASS.

More information on Google Apps Help.

  • 1
    What does the ~ before all do? I know - (strict) and + permissive, but haven't seen that one. – Johan Mar 1 '16 at 19:02
  • The ~ signifies soft-fail – Owen Jul 25 '16 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.