Read include as a conditional match

Consider this illustrative policy:

v=spf1 include:_spf.vendor.example ip4:192.0.2.40 -all

The receiver evaluates the included policy using the original connection. If that evaluation returns pass, the include mechanism matches and its qualifier determines the result. A non-pass result does not simply become the parent policy’s final result: some results cause evaluation to continue, while errors propagate according to RFC 7208. This is why “include means paste the other text here” is an unsafe mental model.

Use include when the current domain owns its policy and wants to authorize a source described by another domain. Keep the provider dependency in the inventory and count its DNS work.

Read redirect as delegation

Now consider:

v=spf1 redirect=_spf.central.example

The redirect modifier is used only after all mechanisms in the original record have been evaluated without a match. Evaluation continues using the target domain’s policy, and the target’s result becomes the result for the original evaluation. A policy containing an all mechanism will match before redirect is reached, making the redirect ineffective.

Use redirect when domains are meant to share a centrally owned policy rather than each composing independent authorizations. Only one redirect modifier is allowed, and an absent target policy is an error rather than a neutral result.

Compare with a controlled matrix

For each design, test:

  1. an IP authorized by the referenced policy;
  2. an IP authorized only by a local mechanism;
  3. an unauthorized IP;
  4. a missing or temporarily unavailable referenced policy.

Record every lookup and final result. Use reserved IP ranges in documentation and a local evaluator; do not send spoofed production traffic.

Choose for ownership, not brevity

Ask who controls the final policy, whether local exceptions are expected, how provider changes are reviewed, and what happens if the referenced domain fails. An include-heavy policy is not automatically more flexible; a redirect is not automatically simpler. Publish the form that matches your governance, then verify it with authoritative DNS and fresh authorized messages. DMARC alignment remains a separate check: an SPF pass for a delegated MailFrom domain does not by itself prove alignment with the visible From domain.