Concept
SPF (Sender Policy Framework) publishes a TXT record listing which servers are authorized to send mail claiming to be from your domain. Receiving mail servers check the actual sending IP against this list. Critically, SPF imposes a hard limit of 10 DNS lookups per evaluation (RFC 7208 §4.6.4) — mechanisms like include:, a, mx, ptr, exists, and redirect each cost one lookup, and nested include: chains (a third-party service's SPF record including yet another service) count too. Exceeding 10 lookups doesn't degrade gracefully — it causes a hard permerror, and SPF stops providing any protection at all for that message.
Common Misconception
"Adding one more include: for a new email tool can't hurt, SPF records don't really run out." They do, and it happens more often than assumed — every third-party sending service (marketing platform, CRM, helpdesk, transactional-email provider) typically wants its own include:, and each of those services' own SPF records may themselves contain further includes. A record that was safely under the limit at 6 lookups can silently cross 10 after the sixth "harmless" addition, and the failure is invisible until deliverability quietly degrades.
Hands-On Exercise
No lab environment needed:
- marinadns.io/mailauth — checks your domain's SPF record, including resolving nested includes and counting total lookups against the 10-lookup ceiling.
- noda.marinadns.io — the SPF Lookup Limit check (CAT-MAIL) flags domains approaching or exceeding the limit as part of a full assessment.
For manually walking through an SPF record term-by-term to count lookups yourself, and constructing a deliberately over-limit record to observe the resulting permerror, see Lesson 8 in the DNS Admin Course Lab Environment page.
Commands to Run
# Read your current SPF record
dig yourdomain.com TXT +short | grep spf1
# Count lookups manually — each of these mechanisms costs 1 lookup: include, a, mx, ptr, exists, redirect
# (there's no single dig command for this — walk the record term by term)
# Test with a real SPF validator tool (MarinaDNS's own /mailauth tool does this)
# or manually resolve each 'include:' target to confirm it resolves and count nested includes
# Simulate exceeding the limit: add enough include: mechanisms to cross 10, then check for permerror
# via a real send-test (mail-tester.com or similar) or a dedicated SPF-lookup-count tool
Fix by flattening (replacing an include: with its resolved IP ranges directly, accepting the maintenance tradeoff) or removing unused includes — never by simply hoping the count stays under 10 as more services get added.
Mastery Checkpoint
You should be able to explain, without looking anything up:
- Which SPF mechanisms count against the 10-lookup limit and which don't.
- Why exceeding the limit causes a hard failure rather than a partial one.
- Why a domain that sends no mail at all should still publish
v=spf1 -all.
If you can answer all three without re-reading this lesson, move to Lesson 9.
← DNS Admin Course Lab Environment
