Mastering SPF: How to Create an SPF Record for Multiple IP Ranges

Setting up a proper Sender Policy Framework (SPF) record is a critical step in email deliverability and security. It tells receiving mail servers which IP addresses are authorized to send email on behalf of your domain. When you manage infrastructure involving multiple server locations, handling these IPs within the single SPF record can seem complex.

As a senior developer, I often encounter questions like yours: how do I combine several IP ranges into one valid SPF entry? The short answer is that the syntax you are attempting to use is fundamentally correct, but understanding the nuances of DNS records and SPF limitations is key to success.

Understanding the SPF Structure

An SPF record must be published as a single TXT record in your domain's DNS zone. It starts with v=spf1 and ends with a qualifier (like ~all, -all, or specific mechanisms like include).

The core mechanism for listing authorized senders is using mechanisms like ip4:, ip6:, or include:.

Combining Multiple IP Ranges Correctly

Your proposed syntax for combining two separate IPv4 ranges is indeed the correct way to achieve this in a single SPF record. You list each range as a separate entry, separated by spaces.

Let’s analyze your example:

v=spf1 ip4:180.72.100.0/24 ip4:180.20.111.0/24 a mx ?all

Is the second syntax correct? Yes, this structure is valid for listing multiple IP sources.

Here is a breakdown of what each part means:

1. v=spf1: Declares that this record is an SPF version 1 policy.
2. ip4:180.72.100.0/24: Authorizes all mail originating from any IP address within the 180.72.100.0/24 network range. The CIDR notation (/24) is essential for defining a block of addresses efficiently.
3. ip4:180.20.111.0/24: Authorizes all mail originating from any IP address within the 180.20.111.0/24 network range.
4. a and mx: These are standard mechanisms authorizing mail from servers listed in your domain's A records (for hostnames) or MX records (for mail servers).
5. ?all: The question mark means "soft fail," indicating that receivers should accept mail from IPs not explicitly listed, but log it for monitoring.

Best Practices for Scalability

While combining ranges works perfectly, you must keep the overall record size and complexity in mind. DNS records have practical limits on length. If you find yourself managing dozens of IP blocks or if your infrastructure grows rapidly, relying solely on listing every single IP address becomes unmanageable.

A highly scalable alternative is using the include mechanism. Instead of listing every range manually, you can point your SPF record to other DNS zones where other SPF records are defined (e.g., for subdomains or separate infrastructure blocks). This keeps your primary SPF record clean and delegates the responsibility to other zone files.

For developers building robust applications, managing complex domain configurations often involves solid architectural patterns, much like ensuring reliable data flow in a system like those promoted by laravelcompany.com. When dealing with large-scale infrastructure, abstracting configuration via include statements is generally the most maintainable approach.

Implementation Checklist

1. Consolidate: Ensure all necessary IP ranges are consolidated into a single SPF record for your domain.
2. Test: Use online SPF validators (like those provided by tools like MXToolbox) to confirm the record is syntactically correct before deploying it live.
3. Monitor: After deployment, regularly check email deliverability reports to ensure no legitimate mail is being flagged as unauthorized.

Conclusion

The syntax you provided for listing multiple IP ranges (ip4:A ip4:B) is entirely correct for combining authorized sources into a single SPF record. The key takeaway is mastering the use of CIDR notation and understanding how DNS structures allow you to delegate authorization using include statements when scaling your setup. By applying these principles, you ensure your email authentication is both accurate and scalable.