Home › Free tools › SPF lookup counter
Type a domain. This page reads its SPF record live from public DNS, follows every include and redirect, and counts the DNS lookups against the limit of 10 in RFC 7208. Each include shows what it costs, and anything that breaks SPF is flagged with a fix.
Nothing is stored or sent to our servers. Your browser asks Cloudflare’s public DNS resolver directly, the same questions a receiving mail server asks. Every lookup goes to cloudflare-dns.com, or to dns.google if Cloudflare does not answer.
Type a domain, such as acme.com, and press Count lookups. A web address or an email address works too. The page shows the total against the limit of 10, the problems it found with what to do about each, the includes that cost the most, and the whole record as a tree: every term, what it costs, and every nested include under the one that pulls it in.
Short answer: An SPF record may cost at most 10 DNS lookups when it is checked (RFC 7208, section 4.6.4). Every include, a, mx, ptr and exists term and every redirect costs one, and each include also costs whatever is inside it. ip4, ip6 and all cost nothing. Over 10, a receiver that evaluates the whole record returns a permerror, and most treat that as an SPF fail.
| Term | Counts towards the 10 | Note |
|---|---|---|
| include: | 1, plus everything in the included record | The usual reason a record goes over |
| a | 1 | Looks up the domain's A and AAAA records |
| mx | 1 | Each of its MX hosts is looked up again; those do not count, but more than 10 hosts is a permerror |
| ptr | 1 | RFC 7208 says not to use it |
| exists: | 1 | Usually with a macro, so its target depends on the sender |
| redirect= | 1, plus everything in the target record | Ignored when the record has an all |
| ip4:, ip6:, all | 0 | No DNS lookup |
The count here is the worst case: the lookups spent when a receiver has to evaluate every term, which is what happens to mail that matches late or not at all. A receiver stops at the first match, so mail from an address listed early can still pass a record that is over the limit.
A void lookup is a term whose name returns nothing: no such domain, or no record of the type asked. RFC 7208 recommends receivers allow at most 2, then return a permerror. A void term can never match, so removing it costs nothing.
Never fix the count by ending in +all or ?all: that stops SPF from protecting anything.
In our fintech email security benchmark, 4.8% of 478 ranked fintech and financial-services domains needed more than 10 DNS lookups to evaluate their SPF record on 30 October 2026, by the email setup checker's estimate.
No. ip4 and ip6 list addresses directly, so a receiver needs no DNS lookup for them. Only include, a, mx, ptr, exists and redirect count.
Yes. An include costs one lookup, plus every lookup inside the record it includes, all the way down. A single provider include can cost three or four.
A lookup that returns no such domain, or no record of the type asked. RFC 7208 recommends that receivers return a permerror after 2. Each one is a term that can never match, so remove it.
Only if something keeps it up to date. A flattened record lists your providers' addresses as they were on the day you flattened it. When a provider adds an address, mail from it fails SPF until the record is rewritten. Use a service or script that re-flattens automatically, or cut includes first.
Some tools do not follow nested includes, some count the address lookups for each MX host, and some stop at the first match. This one follows every include and redirect, does not count MX host lookups, and counts every term, which is the worst case a receiver can hit.
ROI Maximizer is a trading name of M Ventures LTD, registered in England and Wales, company no. 15554493. Registered office: 4 Beau Street, Bath BA1 1QY, United Kingdom. moe@roimaxi.com
© 2024–2026 M Ventures LTD. Privacy notice · Editorial policy · Methodology · Corrections