# SPF record validation now detects misalignments in CIDR syntax

![Validation issues UI showing a misaligned CIDR syntax](2026-05-24-spf-cidr-alignment.png)

SPF record validation now detects when an `ip4` or `ip6` mechanism uses a CIDR prefix length but the IP address is not the network address for that prefix.

For example, `ip4:192.0.2.123/28` is flagged because `.123` is a host address within the `/28` block but not the network address, which would be `.112`. This usually indicates a mistake: the author likely meant either the full network (`ip4:192.0.2.112/28`) or just the single host (`ip4:192.0.2.123`).

The same applies to IPv6: `ip6:2001:db8:abcd:1234::5/48` would be flagged because the network address for `/48` is `2001:db8:abcd::`.

Although the SPF specification doesn't strictly forbid this misaligned syntax, but picky receivers may still flag this as an error. For this reason, this validation issue is now reported as a warning.

The UI also shows proposed corrections for the misaligned mechanism, depending on whether the intended behavior is to authorize the full network or just the single host.