SPF glossary
What does ip4 mean in an SPF record?
By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed July 15, 2026
ip4: authorizes a literal IPv4 address or CIDR range to send mail for your domain — ip4:192.0.2.10 for one server, ip4:192.0.2.0/24 for a block. It costs zero DNS lookups, making it the cheapest and fastest SPF mechanism. The trade-off: you maintain the list by hand when addresses change.
ip4: at a glance | |
|---|---|
| Tag | ip4 (mechanism) |
| Valid values | ip4:<IPv4 address> or ip4:<network>/<prefix>, e.g. ip4:192.0.2.0/24 |
| Default | A bare address with no prefix length matches that single IP (/32). |
| Where it goes | Between v=spf1 and the final all; costs nothing, so order barely matters. |
How ip4: works
ip4: is SPF at its most direct: the authorized addresses are written straight into the record, so the receiver needs no extra DNS queries to evaluate them. A single server is ip4:192.0.2.10; a network is CIDR notation like ip4:192.0.2.0/24.
Because it costs zero of the 10 DNS lookups, ip4: is the mechanism of choice for your own fixed infrastructure — the on-prem mail server, the relay with a static address. When records bump against the lookup limit, converting stable hosts from a/mx/include to ip4: is the standard remedy.
The trade-off is maintenance. Nothing updates an ip4: term but you: when a server moves, the record is wrong until someone edits it. Stale entries cut both ways — a missing new IP fails your own mail, and an old IP you've released may now belong to someone else who can pass your SPF.
Correct record vs common mistake
Correct
v=spf1 ip4:192.0.2.10 ip4:198.51.100.0/24 include:_spf.google.com -allFixed servers listed for free (zero lookups), third-party senders via include.
Common mistake
v=spf1 ip4:192.0.2.0/8 -allA /8 covers 16.7 million addresses — almost certainly including servers you don't control. Scope CIDR ranges to exactly what you own.
Generate your SPF record
Build a correct SPF record for your domain — add your senders, copy the TXT record. Free, no signup.
Who sends email for this domain?
Each service adds its documented include mechanism.
From your provider's docs, e.g. spf.example-esp.com — commas or spaces between multiple. Some services (Klaviyo, HubSpot, Mailchimp Transactional) authenticate through their own CNAME records instead of a shared include — check their DNS settings page.
How should receivers treat everyone else?
Your SPF record
0/10 DNS lookupsPublish as a TXT record at the domain root. One SPF record per domain — if one exists, merge into it instead of adding another.
yourdomain.com (or @)
v=spf1 ~all
Record type: TXT · ip4/ip6 mechanisms don't count against the 10-lookup limit.
After you publish
- Add the TXT record at your DNS host.
- Verify it with the free SPF checker.
- SPF alone doesn't stop spoofing — pair it with DKIM and a DMARC policy. Generate one with the DMARC record generator.
Troubleshooting ip4:
| Issue | Likely cause | Fix |
|---|---|---|
| Mail failing after a server migration | The new server's IP was never added; the record still lists only the old one | Add the new ip4 before cutover and remove the old one after — make SPF part of the migration checklist |
| Old ip4 entries nobody recognizes | Years of accretion — servers decommissioned without record cleanup | Audit against current infrastructure and remove them; a released IP may now belong to someone else |
| Sending IPs keep changing (cloud, autoscaling) | ip4 suits fixed addresses, not dynamic pools | Send through a relay with a stable IP, or use the provider's include — they maintain the ranges |
See this on your own domain
Enter your domain — the check runs instantly on the next page. Free, no signup.
Why it matters for MSPs
Manual IP lists rot, and clients change hosting without telling you. Across 150 tenants, stale ip4: terms are the top reason a migration “finishes” and mail breaks three weeks later — or worse, a released cloud IP gets recycled to a stranger who can now pass SPF for your client. Fleet-wide, hand-maintained address lists need an owner and a review cadence.
Trusted by MSPs
“Palisade allowed our team to deploy DMARC on our domains in minutes instead of hours and making sure our clients are compliant with cutting edge security recommendations from Microsoft.”
Alvin Kalli — CSIO, MSP Corp
Enforce it — don't just monitor it
When a client's infrastructure changes, the first honest signal is a failing source in the DMARC reports. Palisade reads them for every client domain and keeps legitimate senders aligned as things move — so hand-listed IPs don't silently drift out of date on the road to `p=reject`.
Free 15-day trial · No credit card · Your own domain free forever (NFR)