SPF Include vs Redirect: How to Choose & Avoid 5 Mistakes

Updated 8 November 2026 · Standard formula, shown below

This article explains the difference between SPF include and redirect mechanisms, how to choose between them for your domain’s email authentication, and the five most common mistakes that break SPF records. You’ll learn the exact syntax, when each mechanism is appropriate, and how to keep your SPF record within the 10-lookup limit.

How SPF Works: The Basics

SPF (Sender Policy Framework) is a DNS TXT record that publishes which IP addresses are allowed to send email for your domain. When a receiving server gets a message, it looks up your SPF record and checks the sending IP against the listed mechanisms. The result can be pass, fail, softfail, neutral, or none.

Each mechanism is evaluated in order. The first one that matches determines the result, unless a later mechanism overrides it (e.g., +all at the end). The most common mechanisms are:

ip4: – allow a specific IPv4 address or range.
ip6: – allow a specific IPv6 address or range.
include: – allow the senders from another domain’s SPF record.
redirect= – replace the current record with another domain’s SPF record.
-all – fail if no prior mechanism matched.

The key difference is that include: is a partial inclusion – the rest of your record is still evaluated after the include. redirect= is a full replacement – the rest of your record is ignored.

How to Choose: include vs redirect

Use include: when you want to combine multiple sending services (e.g., your own server plus a third-party email provider). Use redirect= when you want to mirror another domain’s SPF policy exactly, usually because you have multiple domains that all use the same sending infrastructure.

Here are concrete scenarios:

Use include: You have your own mail server at mail.example.com and you also use a third-party service like Google Workspace. Your record would be v=spf1 ip4:203.0.113.5 include:_spf.google.com -all.
Use redirect=: You have example.com and example.net both using the same email provider. You set a full SPF record on example.com and on example.net you use v=spf1 redirect=example.com.

In practice, include: is far more common because most domains use more than one sending source. redirect= is useful for domain aliases or when you want to centralize policy.

5 Common Mistakes (and How to Avoid Them)

Exceeding the 10-lookup limit. Each include: counts as a DNS lookup. If you have more than 10 lookups (including nested includes), SPF returns permerror. To avoid this, consolidate includes, use IP ranges when possible, or use a third-party service that aggregates lookups.
Placing redirect= before other mechanisms. redirect= must be the last mechanism in the record. If you put it in the middle, everything after it is ignored, which can cause unexpected failures.
Using redirect= when you need to add your own IPs. If you use redirect=, you cannot add your own IPs or includes. You must use include: instead.
Forgetting the -all or ~all tag. Without a fail or softfail tag, SPF is effectively useless because unauthorized senders will get neutral. Always end with -all (hard fail) or ~all (soft fail) – but not after redirect=.
Using include: with a domain that has no SPF record. This causes a permerror. Always verify that the included domain actually has an SPF record (e.g., _spf.google.com does).

Include vs Redirect: A Side-by-Side Comparison

Aspect	include:	redirect=
Purpose	Add another domain’s senders to your list	Replace your SPF policy with another domain’s
Position in record	Can appear anywhere	Must be last
Effect on rest of record	Continues evaluating after include	Ignores everything after redirect
Use case	Multiple sending sources	Mirroring another domain’s policy
DNS lookups	Counts as one lookup	Counts as one lookup

In short, include: is like adding ingredients to a recipe, while redirect= is like using a different recipe entirely.

Common Related Questions and Misconceptions

Can I use both include: and redirect= in the same record? Technically yes, but it’s almost always a mistake. If you use redirect=, it must be last, and it overrides everything before it. So if you have include: before redirect=, the include is effectively ignored. If you have redirect= before an include:, the include is ignored. In practice, you should choose one approach.

Does redirect= cause a DNS lookup? Yes, it does. It counts as one lookup, just like include:. However, the target domain’s SPF record may itself have multiple includes, which add to the lookup count.

What happens if the redirect target has no SPF record? The SPF check returns permerror, which is treated as a permanent error. Receiving servers may reject the email. Always verify that the target domain has a valid SPF record.

Is redirect= faster than include:? No, both require a DNS lookup. The performance difference is negligible.

Can I use redirect= to point to my own domain? Yes, but it creates a loop. For example, v=spf1 redirect=example.com on example.com would cause a loop and result in permerror. Avoid self-referencing redirects.

Frequently Asked Questions

What is the difference between include and redirect in SPF?

include: adds another domain’s SPF record to your own list of allowed senders, and the rest of your record is still processed. redirect= replaces your entire SPF policy with another domain’s record, and it must be the last mechanism. Use include: when you have multiple sending services; use redirect= when you want to mirror another domain’s policy exactly.

Can I use both include and redirect in the same SPF record?

Yes, but it’s not recommended. If you use redirect=, it must be last, and it overrides everything before it. If you use include: after redirect=, the include is ignored. In practice, choose one approach to avoid confusion.

How many includes can I have in an SPF record?

The SPF specification limits the total number of DNS lookups to 10. Each include: counts as one lookup, and nested includes also count. If you exceed 10, SPF returns permerror. To stay under the limit, combine IP ranges, use a single include for a provider that aggregates, or use a service that reduces lookups.

What does “-all” mean in SPF?

-all means “hard fail” – if the sending IP is not listed in any mechanism, the SPF check fails. This is the strictest policy. ~all means “soft fail” – the message is marked as suspicious but not rejected. Always end your SPF record with one of these, unless you use redirect= (which already includes the target’s policy).

Why does my SPF record show “permerror”?

Common causes include: exceeding the 10-lookup limit, using a malformed mechanism, or including a domain that has no SPF record. Check the syntax and the included domains. Also, ensure redirect= is the last mechanism and points to a valid SPF record.

Does SPF affect email deliverability?

Yes, SPF is one of three authentication methods (along with DKIM and DMARC) that receiving servers use to determine if an email is legitimate. A misconfigured SPF record can cause legitimate emails to be marked as spam or rejected. However, SPF alone is not sufficient; you should also implement DKIM and DMARC for best results.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.