{
  "id": 7584597,
  "title": "SPF redirect vs include: when to use each (and 5 mistakes to avoid)",
  "url": "https://urgent.news/2026/09/15/spf-redirect-vs-include-when-to-use-each-and-5-mistakes-to-avoid",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-15T16:00:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/petr_michal_178dc4f87ad91/spf-redirect-vs-include-when-to-use-each-and-5-mistakes-to-avoid-2i56"
  },
  "original_language": "en",
  "account": "SPF redirect= and include: are two features in SPF that can cause another SPF policy to be evaluated. However, they serve different purposes. A good way to think about them is: include: adds another sender policy to your own, while redirect= delegates the final SPF decision to another domain.\n\nRemember this key point: Use include: when another service is part of your SPF policy. Use redirect= when another domain should own the remaining SPF policy.\n\nHere are five common mistakes to avoid in SPF records:\n\n1. Combining -all and redirect=:\n- When an SPF record has both -all and redirect=, the -all mechanism always matches, resulting in a fail outcome. The redirect= modifier is ignored in this case.\n\n2. Thinking include: imports the other SPF record:\n- The include: mechanism does not simply copy the referenced SPF record. Instead, it evaluates the referenced policy and checks if it returns Pass for the current sender. If not, evaluation continues in the parent record.\n\n3. Using redirect= when include: was intended:\n- When redirect= is used, SPF first checks if the IP matches. If it does, the result is Pass. If not, SPF evaluates the redirected policy. This is useful for centralized SPF management.\n\n4. Redirecting to a broken or missing SPF target:\n- If the target domain does not have a valid SPF record, the result can be PermError, affecting every domain that depends on the central record.\n\n5. Forgetting the 10-DNS-lookup limit:\n- SPF has a limit of 10 DNS-querying terms during evaluation. A record with multiple include: mechanisms and other DNS-dependent mechanisms can quickly exceed this limit, leading to PermError.\n\nTo troubleshoot unexpected SPF behavior, check for the presence of all mechanisms, consider using include: instead, and verify that the redirected SPF target is valid and reliable.",
  "summary": "SPF redirect= vs include: : when to use each SPF has two features that are easy to confuse: include: redirect= Both can cause another SPF policy to be evaluated. But they solve different problems. A useful mental model is: include: -> add another sender policy to your own redirect= -> delegate the final SPF decision That difference sounds small, but it changes how the record behaves. If you only…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}