SPF lookup counter
Count the DNS lookups in a domain's SPF record against the limit of 10, with the include tree, void lookups and duplicate includes.
Run the full email security check DMARC, SPF, DKIM, MX and MTA-STS in one free report.
How it works
Enter a domain and the counter runs the same SPF check as the SPF check and the email security check. It reads the domain's SPF record, follows every include and redirect to the records they point to, and counts each term that costs a DNS lookup. The total at the top, the void lookups and the findings come straight from that check, so the numbers match the full report.
The include tree shows where the lookups go. Each row is one record: the domain it was found at, how it was reached (root, include or redirect), the lookups its own terms cost, and the lookups of the whole branch below it. The branch numbers show which provider uses most of your budget, which is what you need to know before removing anything.
An include that appears more than once is marked. Every copy is looked up again and counts again, so a provider listed twice, often once directly and once inside another provider's record, wastes its whole branch.
The SPF guide explains the mechanisms, the all qualifier and how SPF fits with DKIM and DMARC.
Common mistakes
- One include per vendor. Each marketing, support and billing tool adds its own include, and each of those can contain several more. Five vendors can pass 10 lookups on their own.
- The same include twice. A provider added directly and also included by another record counts twice.
- Leftover includes. Services you no longer use still cost lookups. Remove them.
ptrandexists.ptris deprecated and slow, and both cost lookups for little gain.aandmxby habit. They cost one lookup each and are only needed if the web server or the mail servers really send mail as the domain.- Dead includes. An include that points to a name without an SPF record is a void lookup. Two of them are enough for some receivers to give up.
Limitations
The a, mx and exists terms are counted but not resolved, so void answers from them are not counted, and macros such as %{i} are not expanded. The counter checks the configuration, not the result for a particular sending server.
Frequently asked questions
Why is the limit 10?
RFC 7208 section 4.6.4 caps the DNS lookups a receiver makes while it evaluates SPF at 10, so a single message cannot make a mail server send an unbounded number of queries. The 11th lookup ends the evaluation with a permanent error (PermError), and SPF fails for every message, also the legitimate ones. The full check reports it as SPF_TOO_MANY_LOOKUPS.
Which terms count?
include, a, mx, ptr, exists and the redirect modifier cost one lookup each, and so does every term inside the records they pull in. ip4, ip6 and all cost nothing. A redirect is ignored, and costs nothing, when the record also has an all mechanism.
What is a void lookup?
A lookup that returns no record at all: the name does not exist, or it exists without the record type asked for. RFC 7208 recommends that receivers stop after two of them, which the full check reports as SPF_TOO_MANY_VOID_LOOKUPS. The counter counts void answers for include and redirect targets, the names it actually looks up.
Should I flatten my SPF record?
Usually not. A flattened record replaces includes with the IP addresses they contain today, and providers change those addresses without notice. Remove unused includes first, drop ptr and a or mx terms you do not need, and move senders to subdomains with their own SPF record. The SPF flattener shows what a policy allows, without suggesting a record to publish.
Does a subdomain have its own SPF record?
Yes. SPF is looked up for the exact name in the envelope sender, so news.example.com needs its own record if mail is sent from it. Enter the subdomain to count its lookups. A subdomain does not inherit the record of its parent.
Is the domain stored?
No. Results are kept in memory for up to ten minutes so repeated lookups are fast, and are then gone. The domain is not written to logs and no account is needed.