I have a quick question regarding SPF records: Do they need to be present for all subdomains?

Lets say that I have a TXT record with SPF info for domain.com

Let's also say that I have a seperate email domain for subdomain.domain.com

Will the SPF policy/info for domain.com also apply to the subdomain? Or do I need to add a separate TXT record for that too?

  • 3
    Note that you can have wildcard SPFs for subdomains: search wildcards below.
    – EML
    Feb 13, 2015 at 16:30

6 Answers 6


You need to have separate SPF records for each subdomain you wish to send mail from.

The following was originally posted on openspf.org, which used to be a great resource for this kind of thing.

Latest link http://www.open-spf.org/FAQ/The_demon_question/

The Demon Question: What about subdomains?

If I get mail from pielovers.demon.co.uk, and there's no SPF data for pielovers, should I go back one level and test SPF for demon.co.uk? No. Each subdomain at Demon is a different customer, and each customer might have their own policy. It wouldn't make sense for Demon's policy to apply to all its customers by default; if Demon wants to do that, it can set up SPF records for each subdomain.

So the advice to SPF publishers is this: you should add an SPF record for each subdomain or hostname that has an A or MX record.

Sites with wildcard A or MX records should also have a wildcard SPF record, of the form: * IN TXT "v=spf1 -all"

This makes sense - a subdomain may very well be in a different geographical location and have a very different SPF definition.

The 'include:' directive for SPF may be used to provide all subdomains with the same entries. For example, on the SPF record for subdomain mailfrom.example.com enter 'include:example.com'. In this fashion whenever you update the definition for example.com your subdomains will automatically pick up the updated values.


In addition to the other answers, if a subdomain is created as a CNAME record, the SPF record is the one for the domain it points to, e.g. sub.domain.com is a CNAME of otherdomain.com, the SPF a mailserver will get when it looks up mail@sub.domain.com is in the DNS record for otherdomain.com.

This is the same in practice if the CNAME record says sub.domain.com => othersub.domain.com, so your TXT record would need to be othersub, not sub. This is in contrast to DKIM, which needs a separate TXT record for the public key, even if your subdomain is a CNAME.


But note, as it says in the FAQ referenced in the accepted answer, that you can have wildcard SPFs for a domain for wildcard A or MX records. I have wildcard MX domains, and this works for me:

*.mydomain.org. 3600 IN  TXT  "v=spf1 ip4:IPADDR -all"

with IPADDR replaced with your IP address/range.


No, but you can short-circuit them with the include:maindomain.invalid directive.

  • 1
    Can you elaborate on that? I'm curious... How would that directive work?
    – Mike B
    Oct 19, 2011 at 17:55
*.mydomain.org. 3600 IN  TXT  "v=spf1 ip4:IPADDR -all" 

as written above does not work if the spammer uses a subdomain that is already in dDNS. For example www.domain.com A A records foresides the wildcard in that case.


Be aware that the include statement only includes A-records from the specified domain and not subdomains either. So it does not pick up A-records from subdomains and therefore it only works when all subdomains are on the same server or send from the same server.

  • I don't think this answer pertains to the question (which concerns SPF records, i.e. TXT) at all? Jun 16, 2014 at 11:48
  • I think the warning in this answer was about the case where 1) the top-level domain specified an SPF record including 'a' 2) the sub-domain included the top-level domain SPF, expecting to pick up the exact same set of IP addresses, but actually picked up the sub-domain A record.
    – AdamS
    Mar 18, 2017 at 16:38
  • @AdamS, the opposite actually occurs. Suppose: • example.com A returns; • example.com TXT returns v=spf1 a -all; • sub.example.com A returns; and • sub.example.com TXT returns v=spf1 include:example.com -all. Then mail for sub.example.com is permitted to be sent from alone.
    – Jivan Pal
    Dec 30, 2020 at 0:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.