Is my SPF record valid, and how close is it to the 10-lookup limit?
SPF lists the servers allowed to send as your domain. Each include, a, mx, exists and redirect costs a DNS lookup, and receivers stop at 10. We expand the whole tree live and show what each part costs.
What counts toward the 10
RFC 7208 §4.6.4 limits the terms that make a DNS query, include, a, mx, ptr, exists and the redirect modifier, to 10 per check, including everything nested inside includes. ip4, ip6 and all cost nothing. Separately, more than 2 lookups that return nothing (“void” lookups) is also a PermError.
A PermError means SPF fails for the message; with DMARC, that leaves DKIM as the only way to pass. Trim services you no longer use, and check whether a sender needs the include at all: some authenticate with their own return-path domain.
Build an SPF recordSPF for common senders
- Google Workspace include:_spf.google.com
- Microsoft 365 (Exchange Online) include:spf.protection.outlook.com
- Zoho Mail include:zohomail.com
- GoDaddy email and hosting include:secureserver.net
- Proton Mail include:_spf.protonmail.ch
- Fastmail include:spf.messagingengine.com
- iCloud+ Custom Email Domain include:icloud.com
- Hostinger Email include:_spf.mail.hostinger.com
- SendGrid (Twilio) include:sendgrid.net
- Mailgun include:mailgun.org
Sources
- RFC 7208: Sender Policy Framework · checked 5 Oct 2026
- Google: Email sender guidelines · checked 5 Oct 2026
Related tools
Domain Health Report Everything at once, graded, with the fixDMARC checker RFC 9989 tree walk and policyDKIM checker Common selectors or yoursMTA-STS and TLS-RPT Policy file and reportsDMARC report reader Parsed in your browserDNS lookup Any record, with TTLs explainedWHOIS / RDAP Registrar, expiry, status codes