SPF Lookup Counter
Add your email senders and watch your DNS lookup count update instantly. See if you're over the RFC 7208 limit of 10, preview a flattened or hosted-macro record, then run a live check on your real domain.SPF Lookup Counter
Select senders on the left to build your record
1 lookup
2 lookups
3+ lookups
No senders match your search — add it as a custom include below.
Add custom include
Your SPF record senders
Select senders from the library to start building your SPF record
DNS lookup usage
0 / 10
● Safe (≤7)
⚠ Warning (8–10)
✗ Over limit (>10)
Simulation only — this reflects the record structure your selection would produce, for illustration.
v=spf1 ~all
Illustrative example only — not a ready-to-publish flattened record. The IP ranges shown are static snapshots. A real flattened record needs live DNS resolution of every sender’s current IPs, which ESPs rotate often. Use PowerSPF to generate and continuously maintain a production-ready record.
v=spf1 ~all
Your domain:
This sample will not work if published as-is. The
_spf.powerspf.com host only resolves for domains enrolled in PowerDMARC Hosted SPF. Activate PowerSPF for your domain →
v=spf1 include:yourdomain.com._spf.powerspf.com ~all
How this works
PowerSPF hosts and continuously resolves all your senders’ IP ranges behind a single include, so your DNS TXT record never changes even when ESPs rotate their infrastructure. Result: 1 DNS lookup, zero PermError risk, automatic updates.
Before — 0 lookups
After — 1 lookup ✓
Check your real SPF record
Enter your domain to run a live SPF check — see your actual record, its lookup count, and any errors.
Why Count Your SPF Lookups
The 10-lookup limit is the number one cause of SPF PermError. Because email providers nest their own includes, a record with only a few senders can quietly cross the limit - and you would never know until mail starts failing.
Catch PermError early
Once you pass 10 lookups, receivers return a PermError and treat SPF as failed - even for legitimate mail. This counter shows how close you are before it breaks.
See where lookups come from
We follow every include and redirect to the providers' own records, so you can see exactly which mechanism at which depth is consuming your budget.
Know how to fix it
Spot dead (void) lookups, a weak all qualifier, or deprecated mechanisms - and preview a flattened record that collapses your includes to fixed IPs.
How to Use the SPF Lookup Counter
Counting your SPF lookups takes seconds. Follow these three steps.
1
Pick your senders. Select the ESPs and services you send mail through from the library on the left - or add a custom include like
spf.yourvendor.com.2
Watch the meter on the right. Your picks build a record and the DNS-lookup meter updates instantly, showing how close you are to the limit of 10 and where each lookup comes from.
3
Run a live check. Enter your domain under Check your real SPF record to open the SPF checker and validate your actual published record.
How the SPF Lookup Limit Works
RFC 7208 caps SPF evaluation at 10 DNS lookups. Here is why the limit exists, what breaking it does, and the two ways to fix it.
Why the limit exists
RFC 7208 caps SPF at 10 DNS lookups to stop mail servers being used as DoS amplifiers. Exceeding it returns PermError - and authentication fails regardless of whether the mail is legitimate.
The 10-lookup limit →
What PermError means
PermError is a permanent SPF failure. Many receivers treat it as an outright SPF fail - spam folder or rejection - and it silently breaks DMARC alignment for SPF.
Understand PermError →
How flattening fixes it
Flattening resolves your includes to their underlying
Flattening explained →
ip4/ip6 ranges, removing the lookups - but the IPs must be updated by hand whenever an ESP rotates them.Hosted SPF with macros
A hosted macro record serves your flattened IPs from a single include that never changes - PowerSPF keeps it current automatically, even when providers rotate IPs.
Learn about macros →
DNS Lookup Cost by Mechanism
Not every part of an SPF record costs a lookup. These are the mechanisms and modifiers RFC 7208 counts against your limit of 10 - and the ones that are free.
| Mechanism / modifier | DNS lookups | Why |
|---|---|---|
| include: | 1 each | Recursively evaluates another domain's SPF record. Its own nested includes add more. |
| a / a: | 1 each | Resolves the domain's A / AAAA records to authorise those IPs. |
| mx / mx: | 1 each | Resolves the MX records. Resolving the MX hosts to IPs has its own separate cap of 10. |
| ptr | 1 each | Reverse-DNS check. Deprecated by RFC 7208 - slow and unreliable; avoid it. |
| exists: | 1 each | A macro lookup evaluated per message, commonly used for conditional sending rules. |
| redirect= | 1 each | Delegates the entire policy to another domain's SPF record, which is then evaluated. |
| ip4: / ip6: | 0 | A literal IP address or CIDR range. No DNS query is needed to evaluate it. |
| all | 0 | The terminating catch-all policy (-all, ~all). No DNS query. |
The takeaway: a single include: can cost far more than one lookup, because the provider's record may pull in several more includes of its own. That is why the honest way to know your total is to resolve the whole tree - which is exactly what this tool does above.
Frequently Asked Questions
What is the SPF 10-lookup limit?
RFC 7208 limits an SPF record to 10 DNS lookups during evaluation. The mechanisms that each cost a lookup are
include, a, mx, ptr, and exists, plus the redirect modifier - counted recursively through every include. If the total goes over 10, receivers return a PermError and SPF fails.How is this different from a normal SPF checker?
This tool is a visual simulator: you pick the senders you use and it estimates the DNS lookups your SPF record would cost, updating the meter live as you build. A normal checker instead validates a real, published record. When you want the true numbers for your own domain, use the Check SPF box to run the live SPF checker.
What happens if I exceed 10 DNS lookups?
Receiving servers return a PermError (permanent error). Many treat PermError as an SPF fail, so legitimate mail can land in spam or be rejected. It also breaks DMARC alignment for SPF, which can cascade into DMARC failure if DKIM is not independently passing.
Why does a single include cost more than one lookup?
Because providers nest their own includes. When you add
include:example.com, that record may itself contain two or three more includes - each one is another lookup charged against your 10. That is why a record with only a handful of senders can quietly cross the limit.What are void lookups?
A void lookup is a mechanism that resolves to nothing - an empty answer or a domain with no SPF record. RFC 7208 recommends no more than two; beyond that some receivers return a PermError. They also waste part of your budget, so removing dead includes is worth doing.
Can I publish the flattened record this tool shows?
Treat it as an illustration, not a finished record. The flattened output is a point-in-time snapshot of the IPs your senders resolve to right now. ESPs rotate their IP ranges regularly, so a manually flattened record goes stale and can start failing SPF for legitimate mail. PowerSPF maintains a flattened, hosted record that updates automatically.
Is my domain sent to your servers?
No. The simulator runs entirely in your browser - the senders you pick are never sent anywhere. Only when you use the Check SPF box do we pass the single domain you type to our SPF checker to run the live lookup.
Stop fighting the 10-lookup limit
This counter shows you the problem. PowerSPF fixes it permanently - flattening and hosting your SPF record so it stays under the limit and updates automatically whenever your providers change their IPs.
