SPF uses the deprecated ptr mechanism
What this check looks for
Your SPF record uses a mechanism the standard tells people not to use. It is slow, it puts load on other people's DNS servers, and some receivers ignore it entirely.
Why it matters
Because support is inconsistent, senders you believe are authorised by ptr may not be authorised at all on some receiving systems.
When the check passes, your report says: “SPF uses only mechanisms the standard still recommends”.
What it costs your score
When this check fails it removes 4 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 4 points
- Family cap
- email-auth.spf · 35
- Category
- Email authentication
- Module
- Email spf
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Replace ptr with the explicit ip4:/ip6: ranges or the provider's include.
Support for ptr is inconsistent, so senders you rely on may not be authorised everywhere.
Identify which hosts the
ptrmechanism was meant to authorise.Replace it with
ip4:/ip6:for fixed addresses, or the provider's documentedinclude:.
How to confirm it worked
dig +short TXT ‹domain› — the record must not contain a ptr mechanism
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The record for ‹domain› contains a ptr mechanism. RFC 7208 §5.5 documents it as SHOULD NOT be used: it requires a reverse lookup plus a forward confirmation for every check, it is easy for an attacker to influence, and the RFC notes that some sites ignore it. It also consumes one of the 10 DNS-lookup terms.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other email spf checks
- SPF authorises the whole internet through an address range
- SPF record lists the same sender twice
- SPF include chain contains a loop
- SPF include target has no SPF record
- SPF is close to the 10 DNS lookup limit
- More than one SPF record published
- SPF record has no all mechanism
- No SPF record published
- SPF authorises a very large block of addresses
- SPF ends in +all — anyone may send as your domain
- SPF ends in ?all (neutral)
- SPF has both redirect= and an all mechanism