Replace the ptr mechanism in the SPF record

Why it matters

ptr is deprecated: slow, unreliable when DNS has errors, and adds lookups, so mail relying on it can fail SPF. Listing addresses or includes directly is more reliable.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Work out which servers ptr was authorising: your own mail server (use ip4 or ip6 with its address), or a provider (use that provider's include).
2. Add the replacement terms first, then delete the ptr term, so there is no moment when a sender is missing.
3. Re-scan and watch DMARC reports for a few days for legitimate mail that fails SPF.

; Replace "ptr" with explicit addresses or includes
example.com.  IN TXT  "v=spf1 ip4:203.0.113.25 include:_spf.YOUR-MAIL-PROVIDER.example ~all"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the SPF record check
• Publish an SPF record
• Merge the SPF records into one
• Fix the syntax error in the SPF record
• Replace +all in the SPF record with ~all
• Narrow the very large address range in the SPF record
• Change ?all in the SPF record to ~all
• Choose the right SPF ending for this domain
• End the SPF record with ~all or -all
• Bring the SPF record under 10 DNS lookups
• Leave room under the SPF lookup limit
• Remove SPF terms that point at names that no longer exist
• Fix the SPF include that has no SPF record
• Break the loop in the SPF includes
• Replace the include that has several SPF records
• Check the SPF terms that use macros
• Re-run the scan if part of the SPF record could not be read