SPF "mx" mechanism
The SPF mechanism that matches when the sending IP address belongs to one of the mail exchangers listed in a domain's MX records.
What it means
mx tells receivers that the servers that receive mail for a domain also send it. The receiver looks up the domain's MX records, then the A or AAAA records of each exchanger, and compares the connecting IP address with all of them.
That makes it one of the more expensive mechanisms. The MX lookup counts toward SPF's limit of ten DNS lookups, and RFC 7208 caps the address lookups behind each mx at ten more, returning permerror past that. Unlike ordinary delivery, SPF never falls back to a domain's A record when it has no MX records (the implicit MX rule does not apply here).
If the servers that receive your mail are not the ones that send it, mx authorizes nothing useful. Check where outbound mail actually leaves before keeping it.
Example
v=spf1 mx include:_spf.example.net -allRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 7208: Sender Policy Framework (SPF), section 5.4rfc-editor.org
- RFC 7208: Sender Policy Framework (SPF), section 4.6.4rfc-editor.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes