SPF lookup limit checker
SPF allows ten DNS lookups. Past that, the result is not a warning — it is permerror, and receivers treat the domain as unauthenticated. Includes nest, so a record with four entries can easily cost twelve.
Free, no signup, no daily limit. We do not store what you check here.
Why this breaks after years of working
Nothing about the limit is gradual. A domain at nine lookups authenticates perfectly; add one more provider and every message from every sender fails SPF at once, with no change to any record anybody was watching. Worse, the cost is not visible in your own record: an include you added years ago can grow because the provider behind it added includes of their own, pushing you over the line on a day you changed nothing.
What actually fixes it
Removing providers you no longer use is the first and usually sufficient step — most over-limit records contain two or three includes for services long since cancelled. Flattening, which replaces includes with the addresses they currently resolve to, works and creates a maintenance problem: those addresses change without telling you, and a flattened record goes stale silently. If you flatten, automate the refresh, and never flatten a provider that publishes a large or frequently changing estate.
Questions
Do ip4 and ip6 entries count?
No. Only mechanisms that require a DNS lookup: include, a, mx, ptr and exists. Address literals are free, which is why flattening reduces the count.
What happens at exactly ten?
Ten is allowed; the eleventh is the error. Sitting at ten is not a safe place to be — the next provider you add, or one your provider adds, takes you over without warning.
Related tools
SPF record checker
Check a domain SPF record for syntax problems, soft-fail settings and the 10-lookup limit. Free.
DMARC record checker
Check a domain DMARC policy, alignment and reporting setup. Free live DNS lookup, no signup.
Email deliverability check
One check for MX, SPF, DMARC and DKIM on your sending domain, with what to fix first. Free, no signup.
When you need more than a free tool
This page answers what can be determined offline and from public DNS. The API adds live carrier and mailbox verification, a calibrated confidence score, and the full evidence trail behind every verdict.
Credits never expire. Inconclusive verdicts are never billed. Cancel in one call. See pricing or read the docs.