SPF Lookup Counter
Count the DNS lookups your SPF record really costs — the limit is ten.
How this lookup works
The domain's SPF record is fetched, then every include and redirect inside it is resolved recursively — which is exactly what a receiving mail server does when it evaluates a message. Each include, a, mx, ptr, exists and redirect costs one DNS lookup, and the specification permits ten across the entire evaluation. The eleventh is not a warning: receivers return a permanent error, so SPF stops passing for every message from the domain at once. That shared budget is why adding a single third-party sender can break authentication for everything.
What the results mean
- DNS lookups
- The total an evaluation costs, including everything inside every include. Ten is the hard limit.
- Policy for unmatched mail
- -all rejects, ~all marks as suspicious, ?all has no opinion, and +all authorises the entire internet.
- The tree
- Each include with what it contributes. The expensive one is usually a provider whose own record includes three more.
- Flattening
- Replacing an include with the addresses it resolves to. It fixes the count and has to be maintained by hand when the provider changes IPs.
Common problems and fixes
- We are at eleven and mail is failing
- Remove senders you no longer use first — most domains carry includes for services abandoned years ago. Flattening is the next option and it needs maintaining.
- The count changed without us editing anything
- One of your providers changed their own record. The budget includes everything inside every include, so their change is your problem.
- We have two SPF records
- That is a permanent error on its own — a domain may publish only one. Merge them into a single record.
- SPF passes but DMARC still fails
- SPF has to align with the from domain for DMARC. Mail sent through a provider that passes SPF for their own domain does not align with yours.
Frequently asked questions
What is the SPF 10 lookup limit?
A receiving mail server is permitted to make ten DNS lookups while evaluating a record, counting every include, a, mx, ptr, exists and redirect anywhere in the tree. At the eleventh it returns a permanent error, which means SPF fails for every message from the domain rather than degrading gracefully. The limit exists to stop SPF being used to amplify DNS traffic.
What happens if I exceed it?
Authentication fails permanently for all mail from the domain. If DMARC is set to quarantine or reject and DKIM is not aligned, that mail stops being delivered — not gradually, and with no warning other than the bounces.
Should I flatten my SPF record?
Only when removing unused senders has not brought you under the limit. Flattening replaces an include with the addresses it currently resolves to, which works until the provider changes them — and then your record authorises the wrong hosts and stops authorising the right ones, silently.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/spf-lookup-count/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="SPF Lookup Counter" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/spf-lookup-count/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.