Is your SPF record over the 10-lookup limit?

Frequently asked

What counts as a DNS lookup?

The include, a, mx, ptr and exists mechanisms each cost one lookup, and so does the redirect= modifier. ip4, ip6, all and exp= cost nothing. Crucially, the count is cumulative: every lookup inside every record you include counts against your total too.

Why is the limit 10?

RFC 7208 §4.6.4 caps SPF evaluation at 10 DNS lookups to stop a single message from triggering an unbounded number of queries — SPF records can include each other, so without a cap one record could be used to amplify traffic at a third party.

What happens when a record goes over?

Receivers stop evaluating and return permerror. SPF then neither passes nor fails — it is simply unusable, and under DMARC that means authentication rests on DKIM alone. Nothing bounces, nothing warns you: the record just quietly stops working.

Why do the numbers differ from another checker?

Tools disagree on worst-case versus best-case counting. This one counts every counting term at every occurrence, which is what a receiver evaluating the record can cost — the number you have to stay under. Targets containing macros are counted but never resolved, because macros expand against the sending IP address, which a static check does not have.