An organisation with fifty domains and one mail platform should not maintain fifty copies of the same record. redirect= exists for exactly this, and it is the one modifier worth deploying deliberately.
How it differs from include
| include: | redirect= | |
|---|---|---|
| Meaning | Evaluate that record; a pass here matches. | Abandon this record and use that one instead. |
| The target’s all | Ignored — a fail is simply no match. | Inherited. Its result becomes yours. |
| When used | Any time, mid-record. | Only if no mechanism matched (RFC 7208 §6.1). |
| Per record | Many. | One. |
redirect and all cannot coexist meaningfully
redirect is consulted only when no mechanism has matched — and all always matches. So a record containing both never reaches the redirect. If you find one, someone has misunderstood the modifier, and the record is behaving as though the redirect were not there.
The pattern
# one maintained record _spf.acme.com TXT "v=spf1 include:spf.protection.outlook.com include:_spf.vendor.example ~all" # fifty domains, each a single line that never changes acme.com TXT "v=spf1 redirect=_spf.acme.com" acme.co.uk TXT "v=spf1 redirect=_spf.acme.com" acmegroup.com TXT "v=spf1 redirect=_spf.acme.com" ...
Adding a sender is now one edit rather than fifty, and the fifty cannot drift apart — which is the failure this prevents. Copied records diverge: someone updates the three they remember and the other forty-seven quietly authorise a platform you stopped using.
What it costs
- One lookup, plus the target’s cost. Every redirected domain pays the same total the source record costs. Redirect saves maintenance, not budget.
- A single point of failure. If the target record breaks, every domain pointing at it breaks together. That is the same property that makes it useful, viewed from the other side.
- The terminal qualifier is inherited. Tightening the source record to
-alltightens all fifty at once. Deliberate, and worth saying out loud before you do it.
When not to use it
When the domains genuinely have different senders. Redirect asserts that these domains have the same policy; if acme.co.uk uses a local platform the others do not, forcing it through the shared record either over-authorises the rest or under-authorises it. Group domains by who actually sends for them, then give each group its own source record.