RFC 7208 caps an SPF evaluation at 10 DNS-querying mechanisms. Go over it and the
result is permerror — which most receivers treat as no SPF at all.
Nothing bounces, nothing warns you. Your mail just starts landing in spam.
It is the single most common way a “correct-looking” SPF record is actually dead,
and almost no free checker counts it. MailGate does — it expands
every nested include: and reports the real total.
include:, a, mx, ptr, exists:
— one each, and they nest. An include: that itself contains three
include:s costs four.ip4: and ip6: — free. They are literal addresses, so no
query is needed. This is the key to every fix below.all, redirect= — all is free;
redirect= costs one.Each SaaS tool you add costs at least one, and the big ones cost several internally. A typical company running Google Workspace + a marketing platform + a helpdesk + a billing provider is at 11–14 without doing anything unusual. Nobody exceeds the limit deliberately; you cross it by adding the fourth vendor.
Free, instant, and it is usually enough. Most records carry includes for a platform the company left years ago. Audit every include against tools actually in use today.
Replace a heavy include: with the IP ranges it resolves to. Lookups drop to zero
for that vendor. The trade-off is real: if the vendor changes IPs and you don't update, your
mail fails. Flatten only vendors with stable, published ranges, and re-check quarterly.
Bulk mail rarely needs to come from your apex. Send it from mail.example.com with
its own SPF record and its own budget of 10 lookups. This also protects your main domain's
reputation from marketing-volume complaints.
SPF breaks on forwarding regardless of lookups — the forwarder becomes the sender. DKIM survives forwarding, and DMARC passes if either SPF or DKIM aligns. A domain with solid DKIM is far less fragile than one nursing a 10-lookup SPF record.
ptrIt is deprecated by RFC 7208, slow, and many receivers ignore it. Remove it.
Run your domain through the checker — it reports the expanded lookup count, not just whether a record exists.
Count my SPF lookups — free →MailGate — free SPF, DKIM & DMARC checker. Check any domain →