If an SPF record contains both -all and redirect=, the redirect is ignored—no matter where either term appears. RFC 7208 requires this because the all mechanism always matches. When evaluation reaches -all, the result is SPF fail; the redirect target is not checked.
Why an SPF record ignores redirect when it contains all
SPF checks mechanisms in sequence. When a mechanism matches, its qualifier determines the result. The all mechanism is special: it always matches, and its qualifier supplies the result. Thus -all, if reached, returns fail.
As an Amazon Associate I earn from qualifying purchases.
The rule for redirect= is separate from ordinary term order. RFC 7208 says a redirect modifier must be ignored whenever an all mechanism occurs anywhere in the record. Moving redirect= before or after -all does not change that rule. RFC 7208, Section 5.1
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What happens in a record with both terms
Consider:
v=spf1 include:_spf.vendor.example -all redirect=_spf.example.com
#1 Best Overall
- SPF checks
include:_spf.vendor.example. If that mechanism matches the connecting IP, evaluation ends with the result from the include. - If the include does not match, evaluation proceeds to
-all. - Because
allalways matches,-allreturnsfail. The redirect is ignored because anallmechanism exists in the record.
Putting the redirect earlier does not restore it. RFC 7208 requires it to be ignored regardless of the relative ordering of the terms.
When redirect is evaluated—and what can go wrong
A redirect is considered only after all mechanisms in the source record fail to match, and only when the record has no all mechanism. The target domain is then evaluated using the same connecting IP and sender. If the target has no SPF record, or its name is malformed, the result is permerror, not a neutral result. RFC 7208, Section 6.1
A redirect-based record might have this general form:
Recommended Free Tools
v=spf1 include:_spf.vendor.example redirect=_spf.example.com
Without an all mechanism, the redirect can be used if the include and any other mechanisms do not match. This is an illustration of how the terms interact, not a copy-ready policy: the target must have a valid SPF policy, and the source record must reflect the senders the domain intends to authorize.
Choose between redirect and include
These terms solve different policy problems; redirect= is not another spelling of include:.
| Need | SPF construct | What it does |
|---|---|---|
| Share the complete SPF policy among domains under the same administration | redirect=target |
If no mechanism in the source record matches, evaluate the target domain’s policy. Do not put an all mechanism in the source record. |
| Authorize a provider’s sending infrastructure while keeping the domain’s own policy in control | include:provider |
Check whether the referenced domain’s policy returns pass for the connecting IP. The source record continues to determine its own result. |
| End evaluation with an explicit default result | all, such as -all |
Always matches when reached. Any record containing it must ignore redirect=. |
RFC 7208 describes redirect as a way to consolidate authorization and policy, particularly for domains within one administrative domain. It cautions that redirecting to a domain outside that control may not work reliably, especially if the target policy depends on sender local-parts; an include is generally more suitable for that situation. RFC 7208, Section 5 RFC 7208, Section 6.1
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Redirect still counts toward the SPF DNS lookup limit
RFC 7208 requires SPF implementations to limit DNS-querying terms to 10 during one evaluation. redirect counts toward that limit; exceeding it produces permerror. By contrast, all, ip4, and ip6 do not cause DNS queries during SPF evaluation. Redirect is therefore not a way to bypass the lookup budget. RFC 7208, Section 4.6.4
Quick Recap
How to troubleshoot an ignored SPF redirect
- Read the complete SPF record, including every occurrence of
all. Do not infer behavior from the position ofredirect=. - If any
allmechanism is present, treat the redirect as ignored under RFC 7208. - Choose the intended policy structure: use
allto provide an explicit ending result, or useredirect=to delegate the shared policy when mechanisms do not match. Do not combine them expecting the redirect to run. - Check that the resulting policy authorizes the domain’s intended senders and remains within the 10-term DNS-query limit.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
