Before changing SPF, identify the domain your sending service uses for its envelope-from address. That address receives bounces and can differ from the From address your recipient sees.
Which domain does SPF check?
SPF checks the domain in SMTP MAIL FROM, the envelope-from address, or the server's HELO identity. HELO is the hostname a sending server presents when opening the SMTP conversation.
The receiver already knows the connecting IP when it receives MAIL FROM, so SPF can run before the message body arrives. When the envelope sender is empty, as in MAIL FROM:<>, SPF uses the HELO identity. RFC 7208, the SPF standard, also recommends checking HELO separately.
SPF does not check the visible From address. DMARC alignment connects an authenticated domain to that address.
What does an SPF record look like?
An SPF record is a DNS TXT record whose value starts with v=spf1, followed by authorization rules.
example.com TXT "v=spf1 include:mailprovider.example ~all"Here, include:mailprovider.example authorizes IPs that pass that provider's SPF policy. ~all produces a softfail for other IPs. Replace the example provider with the policy your sending service publishes.
What do the mechanisms and modifiers mean?
Mechanisms test the connecting IP against a condition. The redirect modifier delegates evaluation when no mechanism matches.
| Term | Effect |
|---|---|
ip4, ip6 | Match an address or network written directly in the record. |
a | Match an address returned for the named domain, using the connection's IP family. |
mx | Match an address of a mail exchanger for the named domain. |
include | Match when the referenced policy returns pass for this IP. |
exists | Match when the specified DNS name has an A record; macros can construct that name from the connection. |
redirect= | Evaluate another domain's policy when no mechanism matches; an all mechanism makes it ineffective. |
ptr | Check validated reverse-DNS names; do not add it to new records because the lookup is slow and unreliable. |
all | Match every remaining IP, with its qualifier determining the result. |
The address mechanisms are spelled ip4 and ip6. A ptr entry can appear in an older policy, but RFC 7208 discourages its use while requiring validators to support it.
What do the all qualifiers change?
The qualifier sets the SPF result for an IP that reaches all; the receiver decides how to handle the message.
| Ending | Result |
|---|---|
-all | Fail: the domain does not authorize the IP. |
~all | Softfail: the domain considers the IP probably unauthorized. |
?all | Neutral: the domain makes no assertion. |
+all | Pass for every IP, removing the restriction SPF would otherwise provide. |
How do example records evaluate?
Each example below illustrates a separate policy. The IPs and domains are documentation examples, not values to publish for your sender.
| Record | What it authorizes |
|---|---|
v=spf1 mx ip4:192.0.2.10 ip4:198.51.100.0/24 ~all | The domain's mail exchangers, one IP and the listed network; other IPs softfail. |
v=spf1 a ip4:192.0.2.0/25 ip4:198.51.100.0/26 -all | The domain's address records and two networks; other IPs fail. |
v=spf1 -all | No IPs; every attempted use of this domain fails SPF. |
v=spf1 +all | Every IP, so it provides no sending restriction. |
v=spf1 redirect=_spf.example.com | Whatever the policy at _spf.example.com authorizes. |
v=spf1 exists:%{i}._spf.example.com ~all | IPs whose expanded lookup name returns an A record; other IPs softfail. |
For the exists example, a connection from 192.0.2.10 produces the lookup name 192.0.2.10._spf.example.com. You must operate the DNS records that make such a policy work; the pattern does not authorize a provider by itself.
How many DNS lookups can SPF use?
SPF permits ten evaluated DNS-querying terms across the policy and nested evaluations. An eleventh produces permerror, so adding another provider can break evaluation instead of authorizing it.
The counted terms are include, a, mx, ptr, exists and redirect. Literal ip4, ip6 and all terms do not consume that allowance. It counts terms, not simply every DNS packet. The return-path CNAME supplies Bird's SPF authorization without adding an apex include.
Why can forwarded mail fail SPF?
A forwarder or mailing list can resend legitimate mail from an IP that the original envelope-from domain does not authorize. For example, an alumni mailbox forwarding to a personal mailbox changes the connecting server seen by the final receiver.
If the envelope-from address stays unchanged, SPF evaluates that new server against the original domain's policy. A forwarder can rewrite the envelope-from address using Sender Rewriting Scheme (SRS) to authenticate its own domain. That does not by itself align SPF with the original visible From address.
An intact, aligned DKIM signature can still provide a DMARC pass. Authentication does not establish that a message is wanted or guarantee inbox placement.
What should you publish for Bird?
You publish the return-path CNAME supplied for your sending domain. It points to Bird's bounce infrastructure, which already provides SPF authorization. You do not need an additional SPF include at your apex domain to send through Bird.
Keep an existing apex SPF record for other senders unchanged. Copy the domain's dns_records. Verify capabilities.return_path.status; check capabilities.sending.status for readiness across all sending requirements. Both status fields use these values:
| Status | Meaning and action |
|---|---|
pending | Verification has not run or is running; wait for its result. |
verified | The capability's DNS records match the expected values. |
warning | Previously verified records no longer match; fix them before the grace period ends. Sending is not yet affected. |
failed | A DNS value is wrong; correct it. |
temporary_failure | A DNS lookup failed transiently; verification retries automatically. |
not_configured | The capability is not set up for this domain. |
You verify DKIM, return-path and DMARC before sending. You can change the return-path hostname. If a DNS TXT value needs multiple quoted strings, the DNS record splitter formats those strings without changing SPF's lookup allowance.