Include mechanism

What it means

include is how a domain authorizes a sending service it does not run, such as a mailbox provider or an email platform: include:_spf.google.com borrows Google's list of sending addresses. The receiver evaluates the named domain's SPF record with the same IP address and sender. If that evaluation returns pass, the include matches and the qualifier in front of it (usually the default +) gives the result.

Only a pass matches. A fail, softfail or neutral inside the included record does not end the check; evaluation simply moves on to the next term of the parent record. RFC 7208 notes the name was a poor choice, since nothing is copied in. If the included domain has no SPF record, the result is permerror.

Every include costs one DNS lookup toward the limit of ten, and so does every lookup inside the included record, which is how records quietly exceed the limit.