ptr mechanism
The SPF mechanism that matches when the sending IP address has a verified reverse DNS name inside a given domain; RFC 7208 says not to use it.
What it means
ptr takes the connecting IP address, looks up its PTR records, confirms each returned name by looking up its addresses, and matches if a confirmed name ends in the target domain. It ties SPF to reverse DNS, which the IP address owner controls rather than the domain owner.
RFC 7208 says it should not be published: it is slow, unreliable when DNS errors occur, and puts heavy load on the in-addr.arpa and ip6.arpa servers. Receivers must still support it, so old records keep working. Replace it with ip4, ip6 or include.
The PTR lookups count toward SPF's limit of ten lookups, and only the first ten names returned are checked.
Example
v=spf1 ptr:example.com -allRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 7208: Sender Policy Framework (SPF), section 5.5rfc-editor.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes