The "a" mechanism (edit)
a
a/<prefix-length>
a:<domain>
a:<domain>/<prefix-length>
All the A records for domain are tested. If the client IP is found among them, this mechanism matches.
If domain is not specified, the current-domain is used.
The A records have to match the client IP exactly, unless a prefix-length is provided, in which case each IP address returned by the A lookup will be expanded to its corresponding CIDR prefix, and the client IP will be sought within that subnet.
v=spf1 a -all
The current-domain is used.
v=spf1 a:example.com -all
Equivalent if the current-domain is example.com.
v=spf1 a:mailers.example.com -all
Perhaps example.com has chosen to explicitly list all the outbound mailers in a special A record under mailers.example.com.
v=spf1 a/24 a:offsite.example.com/24 -all
If example.com resolves to 192.0.2.1, the entire class C of 192.0.2.0/24 would be searched for the client IP. Similarly for offsite.example.com. If more than one A record were returned, each one would be expanded to a
CIDR subnet.
