An SPF record is a single DNS TXT record that begins with v=spf1 followed by space‑separated terms—mechanisms with optional qualifiers, then modifiers—evaluated left to right until the first match. The syntax is strict: any stray character causes a Perm Error, and the version tag must be exactly v=spf1; a typo like v=spf10 discards the record.

Mechanisms such as include, ip4, ip6, and all are most common. include recurses into another domain’s SPF record and passes only if that record returns Pass; it does not splice the record. all always matches and must appear last; anything after it is ignored. The deprecated ptr mechanism is still in ~1.4% of domains, but RFC 7208 advises never publishing it because it is slow and unreliable.

Modifiers provide additional context. redirect transfers the entire evaluation to another domain’s record after all mechanisms fail, while exp supplies a human‑readable explanation on failures. Neither modifier counts toward the lookup limit, though redirect does count as a single DNS lookup.

Macros (e.g., %{d2}) allow dynamic authorization by expanding message properties at evaluation time, a technique used in Salesforce’s current record. Understanding these elements ensures compliant, efficient SPF deployment.