SPF Record Checker with DNS lookup counter

Why the 10-lookup limit matters for cold email

RFC 7208 caps SPF evaluation at 10 DNS lookups. Every include:, a, mx, exists: and redirect= costs one — including the ones nested inside your ESPs' own includes. Google Workspace costs 1 (they flattened theirs), but many ESPs cost 2–4 each.

Stack Google Workspace + an outreach tool + a marketing platform + a CRM and you can quietly cross the limit. Past 10, receivers return permerror and treat your mail as failing authentication. Nothing bounces. Your open rate just dies.

Common SPF errors this tool catches

• More than 10 DNS lookups — permerror; flatten includes or remove unused senders.
• Multiple SPF records — also permerror. You get one v=spf1 record per domain; merge them.
• +all — authorizes the entire internet to send as your domain.
• Dead includes — an include: pointing at a domain with no SPF record.
• Deprecated ptr — slow, unreliable, and discouraged by the RFC.

FAQ

Does ip4:/ip6: count toward the limit?

No. IP mechanisms are free — that's why "SPF flattening" (replacing includes with their resolved IPs) fixes lookup overflow.

Is ~all or -all better for cold email?

~all (softfail) is the safe default and what Google uses. -all is stricter; only use it once you're certain every legitimate sender is in the record.