SPF DNS lookup cost of every major provider's include — measured

Short answer: an include is not always one lookup, and the numbers in most guides are stale. As measured today, Google Workspace and Microsoft 365 have both flattened their records and cost 1 each — not the 4 that older articles still quote — while Zoho costs 5, Mailgun 5, and Stripe and Freshdesk 8 each, because their records nest other providers' includes. A typical stack of a mailbox provider plus a CRM, a helpdesk and a payments platform can pass 10 with only four includes, which is why "too many DNS lookups" permerrors appear the week someone adds one more tool. Look up each provider below, add them, and keep the total at 8 or under so the next tool doesn't break authentication.

Lookup cost by provider

Cost = the include itself (1) plus every include, a, mx, exists and redirect mechanism it triggers, followed recursively, exactly as RFC 7208 section 4.6.4 requires receivers to count. Providers change their records; the figures below are what the resolver saw on the date above.

Provider	Mechanism	Lookups consumed	Weight
Freshdesk	include:spf.freshdesk.com	8	Heavy — budget for it
Stripe	include:stripe.com	8	Heavy — budget for it
Mailgun	include:mailgun.org	5	Heavy — budget for it
Zoho Mail	include:zoho.com	5	Heavy — budget for it
GoDaddy / Secureserver	include:secureserver.net	3	Moderate
Hostinger	include:_spf.mail.hostinger.com	3	Moderate
HubSpot	include:_spf.hubspot.com	3	Moderate
OVH	include:mx.ovh.com	3	Moderate
Atlassian (Jira/Confluence)	include:_spf.atlassian.net	2	Light
Elastic Email	include:_spf.elasticemail.com	2	Light
ProtonMail	include:_spf.protonmail.ch	2	Light
Salesforce	include:_spf.salesforce.com	2	Light
SendGrid (Twilio)	include:sendgrid.net	2	Light
SMTP.com	include:spf.smtp.com	2	Light
SparkPost	include:sparkpostmail.com	2	Light
ActiveCampaign	include:emsd1.com	1	Light
Amazon SES	include:amazonses.com	1	Light
Brevo (Sendinblue)	include:spf.brevo.com	1	Light
Constant Contact	include:spf.constantcontact.com	1	Light
Fastmail	include:spf.messagingengine.com	1	Light
Google Workspace / Gmail	include:_spf.google.com	1	Light
IONOS	include:_spf-eu.ionos.com	1	Light
Mailchimp	include:servers.mcsv.net	1	Light
Mailersend	include:_spf.mailersend.net	1	Light
Mailjet	include:spf.mailjet.com	1	Light
Mandrill	include:spf.mandrillapp.com	1	Light
Microsoft 365 / Exchange Online	include:spf.protection.outlook.com	1	Light
Mimecast (EU)	include:eu._netblocks.mimecast.com	1	Light
Mimecast (US)	include:us._netblocks.mimecast.com	1	Light
Postmark	include:spf.mtasv.net	1	Light
SendPulse	include:mxsspf.sendpulse.com	1	Light
Shopify	include:shops.shopify.com	1	Light
Zendesk	include:mail.zendesk.com	1	Light

Not measured (no SPF record found at the mechanism we tested, so the provider uses a different or per-account include): _spf.klaviyo.com, _spf.intercom.io, _spf.frontapp.com, spf.docusign.net, _spf.outreach.io, spf.salesloft.com, _spf.apollo.io, _spf.customeriomail.com, spf.moosend.com, spf.ppe-hosted.com, spf.barracudanetworks.com.

Common stacks, added up

Each row is a realistic combination, summed from the measured values above. Anything over 10 returns permerror at every receiver that evaluates SPF properly.

Stack	Includes	Total	Result
SDR team on Workspace + a sequencer relay + CRM	Google Workspace / Gmail (1) + Salesforce (2) + HubSpot (3)	6 / 10	OK
Workspace + Mailchimp + Zendesk + Stripe	Google Workspace / Gmail (1) + Mailchimp (1) + Zendesk (1) + Stripe (8)	11 / 10	permerror — SPF fails
Microsoft 365 + SendGrid + HubSpot + DocuSign	Microsoft 365 / Exchange Online (1) + SendGrid (Twilio) (2) + HubSpot (3)	6 / 10	OK
Microsoft 365 + Mimecast + Salesforce + Zendesk	Microsoft 365 / Exchange Online (1) + Mimecast (US) (1) + Salesforce (2) + Zendesk (1)	5 / 10	OK
Workspace + Microsoft 365 (migration overlap) + Mailgun	Google Workspace / Gmail (1) + Microsoft 365 / Exchange Online (1) + Mailgun (5)	7 / 10	OK
Shopify store: Shopify + Klaviyo + Workspace + Zendesk	Shopify (1) + Google Workspace / Gmail (1) + Zendesk (1)	3 / 10	OK

Why the count is higher than the number of includes

• Nesting. zoho.com contains four further includes; spf.freshdesk.com includes SendGrid and Mailgun, and inherits everything inside them. Each level is a lookup.
• Flattening by the big providers. Google and Microsoft have flattened their includes to plain IP ranges, so the widely quoted "Workspace costs 4" is no longer true — measure, don't assume.
• a and mx mechanisms inside a provider's record each cost a lookup, even though you never wrote them.
• Redirects count too, and everything inside the redirect target counts.
• Duplicates still count. If two of your providers both include the same upstream, receivers may resolve it twice. Our counter de-duplicates, so treat our figure as the floor.
• Void lookups (an include that returns no SPF record) count against a separate limit of 2 and cause permerror on their own. The checker above flags them.

What to do when you're over 10

1. Remove what you don't send from. Most over-limit records carry includes for tools that were trialled and abandoned. Check each provider's sending logs before keeping its include.
2. Move streams to subdomains. Marketing on news.yourdomain.com, transactional on mail.yourdomain.com, each with its own SPF record and its own 10-lookup budget. This also isolates reputation, which matters more than the SPF limit.
3. Flatten last, not first. Replacing includes with IP ranges reduces lookups to zero but breaks silently the next time the provider changes its ranges. If you flatten, automate the re-flattening or monitor the record for drift.
4. Keep two lookups in reserve. A record at exactly 10 fails the day a provider adds one nested include to its own record — which happens without notice.

FAQ

Does the 10-lookup limit apply to ip4: and ip6:?

No. IP mechanisms cost nothing, which is why flattening works. The limit applies to mechanisms that need DNS to evaluate: include, a, mx, ptr, exists and redirect.

Will a permerror bounce my mail?

Usually not by itself. Receivers treat SPF as failed or unavailable, which means DMARC can't pass on SPF alignment; if DKIM is also missing or misaligned, DMARC fails and your policy decides the outcome. In practice, permerror plus a p=reject policy does bounce mail.

How often do these numbers change?

Providers restructure their records a few times a year, usually without announcement. We re-measure this table on every revision and publish the date; the JSON carries the same date field for anyone automating checks.

Can I stay under the limit and still use many providers?

Yes, through subdomains. There is no rule that all mail must come from the apex domain; SDR teams routinely run outreach from a dedicated subdomain or a lookalike domain precisely to keep the primary domain's SPF small and its reputation separate.