SPF glossary
What does ip4 mean in an SPF record?
By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed July 15, 2026
ip4: authorizes a literal IPv4 address or CIDR range to send mail for your domain — ip4:192.0.2.10 for one server, ip4:192.0.2.0/24 for a block. It costs zero DNS lookups, making it the cheapest and fastest SPF mechanism. The trade-off: you maintain the list by hand when addresses change.
ip4: at a glance | |
|---|---|
| Tag | ip4 (mechanism) |
| Valid values | ip4:<IPv4 address> or ip4:<network>/<prefix>, e.g. ip4:192.0.2.0/24 |
| Default | A bare address with no prefix length matches that single IP (/32). |
| Where it goes | Between v=spf1 and the final all; costs nothing, so order barely matters. |
How ip4: works
ip4: is SPF at its most direct: the authorized addresses are written straight into the record, so the receiver needs no extra DNS queries to evaluate them. A single server is ip4:192.0.2.10; a network is CIDR notation like ip4:192.0.2.0/24.
Because it costs zero of the 10 DNS lookups, ip4: is the mechanism of choice for your own fixed infrastructure — the on-prem mail server, the relay with a static address. When records bump against the lookup limit, converting stable hosts from a/mx/include to ip4: is the standard remedy.
The trade-off is maintenance. Nothing updates an ip4: term but you: when a server moves, the record is wrong until someone edits it. Stale entries cut both ways — a missing new IP fails your own mail, and an old IP you've released may now belong to someone else who can pass your SPF.
Correct record vs common mistake
Correct
v=spf1 ip4:192.0.2.10 ip4:198.51.100.0/24 include:_spf.google.com -allFixed servers listed for free (zero lookups), third-party senders via include.
Common mistake
v=spf1 ip4:192.0.2.0/8 -allA /8 covers 16.7 million addresses — almost certainly including servers you don't control. Scope CIDR ranges to exactly what you own.
Generate your SPF record
Build a correct SPF record for your domain — add your senders, copy the TXT record. Free, no signup.
Who sends email for this domain?
Each service adds its documented include mechanism.
From your provider’s docs, e.g. spf.example-esp.com — commas or spaces between multiple. Some services (Klaviyo, HubSpot, Mailchimp Transactional) authenticate through their own CNAME records instead of a shared include — check their DNS settings page.
How should receivers treat everyone else?
Your SPF record
0/10 lookupsPublish as a TXT record at the domain root. One SPF record per domain — if one exists, merge into it instead of adding another.
yourdomain.com (or @)v=spf1 ~allClick the record to select all of it.
Record type: TXT · ip4/ip6 mechanisms don’t count against the 10-lookup limit.
After you publish
- Add the TXT record at your DNS host.
- Verify it with the free SPF checker.
- SPF alone doesn’t stop spoofing — pair it with DKIM and a DMARC policy. Generate one with the DMARC record generator.
Troubleshooting ip4:
| Issue | Likely cause | Fix |
|---|---|---|
| Mail failing after a server migration | The new server's IP was never added; the record still lists only the old one | Add the new ip4 before cutover and remove the old one after — make SPF part of the migration checklist |
| Old ip4 entries nobody recognizes | Years of accretion — servers decommissioned without record cleanup | Audit against current infrastructure and remove them; a released IP may now belong to someone else |
| Sending IPs keep changing (cloud, autoscaling) | ip4 suits fixed addresses, not dynamic pools | Send through a relay with a stable IP, or use the provider's include — they maintain the ranges |
Why it matters for MSPs
Manual IP lists rot, and clients change hosting without telling you. Across 150 tenants, stale ip4: terms are the top reason a migration “finishes” and mail breaks three weeks later — or worse, a released cloud IP gets recycled to a stranger who can now pass SPF for your client. Fleet-wide, hand-maintained address lists need an owner and a review cadence.
Trusted by MSPs
“Their responsive support, agent task lists, white-label reporting, and centralized dashboard make managing our customer domains, effortless.”
Bobby Ghoshal — CEO, dupe.com
DMARC software that does the work
When a client's infrastructure changes, the first honest signal is a failing source in the DMARC reports. Palisade reads them for every client domain and keeps legitimate senders aligned as things move — so hand-listed IPs don't silently drift out of date on the road to `p=reject`.
1 domain free up to 1,000 emails/month
Questions readers ask