CIDR (Classless Inter-Domain Routing)

What Is CIDR?

CIDR (Classless Inter-Domain Routing) is a method for allocating IP addresses and routing internet traffic more efficiently. It replaces the older “class-based” system of IP address distribution by allowing networks to be divided into variable-sized blocks, known as CIDR blocks.

In simple terms, CIDR defines how many IP addresses are grouped together and how routers interpret them. In email systems, CIDR notation is frequently used in SPF records to specify which IP ranges are authorized to send mail for a domain.

How Does CIDR Work?

CIDR notation combines an IP address with a prefix length that indicates how many bits of the address represent the network portion.

For example:

• 192.0.2.0/24 refers to 256 IP addresses, from 192.0.2.0 to 192.0.2.255.
• 192.0.2.0/28 refers to 16 IP addresses, from 192.0.2.0 to 192.0.2.15.

The number after the slash (/) is the subnet mask, which determines how many addresses belong to the same network.

CIDR allows network administrators to assign IP ranges more flexibly, reducing waste and improving routing efficiency across the internet.

CIDR in Email Authentication

In SPF records, CIDR notation is used to define authorized sending ranges for a domain.

For example:

This record tells receiving servers that any IP within the 203.0.113.0 to 203.0.113.255 range is allowed to send mail on behalf of the domain.

Using CIDR helps organizations avoid listing every individual IP address and makes it easier to manage large or dynamic mail infrastructures. However, misconfigured CIDR ranges can lead to authentication failures or unintentionally allow unauthorized senders, so careful planning is essential.

CIDR and DMARCeye

DMARCeye helps organizations interpret SPF and DMARC reports that include IP addresses defined by CIDR blocks.

By grouping sending IPs under their CIDR ranges, DMARCeye identifies patterns, detects unauthorized traffic, and highlights potential misconfigurations in SPF policies.

This helps administrators understand where their legitimate mail is coming from, which subnets are in use, and whether all sending sources align properly under DMARC authentication.