SPF Lookup Counter
Ensure your SPF record does not exceed the 10-lookup limit.
SPF Lookup Counter
Recursively trace a domain's SPF record to ensure it does not exceed the strict RFC limit of 10 DNS lookups.
Enter a domain above to recursively trace its SPF include tree.
The 10-Lookup Limit Explained
According to RFC 7208, SPF records are strictly limited to a maximum of 10 DNS lookups. This limit prevents Denial of Service (DoS) attacks that could be caused by recursive or maliciously chained SPF records.
What counts as a lookup?
- include: Counts as 1 lookup, PLUS any lookups inside the included domain's SPF record.
- a: Counts as 1 lookup.
- mx: Counts as 1 lookup to get the MX records, plus up to 10 A-record lookups for the returned mail servers. (For simplicity, the initial MX query is the guaranteed 1 lookup).
- ptr: Counts as 1 lookup (though highly discouraged to use).
- exists: Counts as 1 lookup.
- redirect: Counts as 1 lookup.
What DOES NOT count as a lookup?
- ip4: Specifies an IPv4 address or subnet. No DNS lookup required.
- ip6: Specifies an IPv6 address or subnet. No DNS lookup required.
- all: Evaluates locally without DNS queries.
What if I exceed 10 lookups? Emails sent from your domain will likely fail SPF checks with a "PermError" resulting in your emails going to Spam folders or being rejected outright. If you have too many includes (e.g. Google, Outlook, Sendgrid, MailChimp), you may need to use an "SPF Flattening" service or condense your records into IP addresses.
Related Guides
Deepen your understanding with our expert articles.