SPF include vs redirect: Key differences and five common configuration mistakes

SPF records offer two mechanisms — include: and redirect= — that both trigger evaluation of external policies but serve distinct purposes. The include: directive adds an external sender as one of several authorized senders while keeping the parent domain in control of the final SPF decision. The redirect= modifier delegates the entire remaining SPF decision to another domain and is ignored when an 'all' mechanism is present in the same record, a common misconfiguration. Using redirect= alongside -all is a frequent mistake, as the 'all' mechanism always produces a result first, rendering the redirect irrelevant per RFC 7208. Choosing between the two comes down to ownership: use include: when your domain retains final authority, and redirect= when another domain should fully govern the remaining policy.