All tools
DELIVERABILITY TOOL / 07SPF lookup
SPF lookup
budget checker
Follow the policy graph—not just the first TXT record. Find the exact terms consuming SPF’s ten-lookup budget and the vendors hidden behind each include.
- Recursive chain trace
- RFC 7208 accounting
- Exportable evidence
Choose a source
Live lookups use Google Public DNS over encrypted HTTPS with EDNS client subnet disabled. The queried domain names go to Google’s resolver; no mailbox, message content, or account data is involved.
Trace the record before changing it.
Run a live check or inspect a draft. The result will show the recursive lookup path, remaining budget, terminal policy, and every unresolved assumption.
A RUNTIME LIMIT
Ten is the maximum evaluated DNS terms—not the number of TXT queries shown in a log.
RFC 7208 requires an SPF implementation to stop with a permanent error when evaluation exceeds ten lookup-causing mechanisms and modifiers. The original SPF TXT lookup is not one of those terms. Includes and redirects consume one term themselves, and their recursively evaluated policies consume more.
v=spf1 ip4:192.0.2.10 include:a.example include:b.example -allip40
include:a1 + child
include:b1 + child
-all0
TERM ACCOUNTING
Count evaluation work, then inspect its shape.
includeCounts
Fetches and evaluates another domain’s SPF policy.
aCounts
Looks up A or AAAA addresses for a target name.
mxCounts
Looks up MX hosts and then their addresses, with additional per-mechanism limits.
ptrCounts
Reverse-maps the client IP; RFC 7208 says publishers should not use it.
existsCounts
Tests whether a macro-expanded domain has an address result.
redirectCounts
Evaluates another policy only after all mechanisms fail to match.
ip4 / ip6Free
Compares the client address directly without a runtime DNS term.
allFree
Always matches and terminates mechanism evaluation.
A receiver should also limit “void lookups”—queries returning no usable answer or a name error—to two. A static policy graph cannot predict every void lookup because a, mx, exists, and macros depend on the evaluated sender and DNS state at that moment.
THE LAST MECHANISM MATTERS
A valid budget can still publish a weak policy.
The qualifier on all determines the result for a client that matched no earlier mechanism. -all returns fail, ~allreturns softfail, ?all returns neutral, and +allauthorizes every client. A missing terminal mechanism behaves like?all unless a reachable redirect supplies the policy.
SPF authenticates the MAIL FROM domain. DMARC separately asks whether that authenticated domain aligns with the visible From domain.
REDUCE DEPENDENCY FIRST
Flattening is a cache you now have to operate.
Begin by removing abandoned senders, duplicate includes, unnecessarya or mx mechanisms, and vendor chains that authorize services you do not use. Split organizational mail streams onto intentional MAIL FROM subdomains where appropriate. If a system replaces includes with IP addresses, it must continuously follow provider changes, respect TTLs, update atomically, preserve IPv4 and IPv6 coverage, and fail visibly.
RemoveUnused vendor authorizationBest first step
SeparateIndependent MAIL FROM streamsReduces coupling
FlattenProvider IP dependenciesCreates operations work
COMMON QUESTIONS
Before editing the record.
Does the initial TXT query count toward ten?+
No. The limit applies to evaluated include, a, mx, ptr, exists, and redirect terms. Recursive work triggered by includes and redirects is included.
Do several ip4 mechanisms consume several lookups?+
No. ip4 and ip6 compare the client address directly and do not consume the ten DNS-term budget, though an excessively large or hard-to-maintain record can create other operational problems.
Why is the result sometimes shown as a lower bound?+
A missing record, DNS error, loop, macro-expanded include, or safety traversal limit prevents a complete recursive total. The known terms still matter, but the tool will not pretend the unseen work is zero.
Can I publish multiple SPF records to get more space?+
No. More than one SPF record selected for the same name produces a permanent error. Consolidate authorization into one v=spf1 TXT record.
Does SPF pass mean DMARC passes?+
Only if the SPF-authenticated MAIL FROM domain aligns with the visible From domain under the DMARC policy. An aligned DKIM pass can also satisfy DMARC independently.
KEEP DIAGNOSING
AUTHENTICATION IN CONTEXT
Keep sending identity connected.
Manage authenticated domains, campaigns, product email, and delivery activity in one workspace.
Start for free