Why does SPF have a 10 lookup limit?

SPF is evaluated during SMTP delivery, so the standard limits DNS-querying mechanisms to protect receivers from expensive or recursive DNS work.

Do ip4 and ip6 mechanisms count as SPF DNS lookups?

No. Direct ip4 and ip6 mechanisms do not add DNS lookups. Mechanisms such as include, a, mx, ptr, exists, and redirect do.

Is SPF flattening always better?

Not always. Flattening can reduce DNS lookups, but flattened IP ranges can become stale if a provider changes its sending infrastructure.

SPFPROBLEM.comSPF Record Analysis

About SPF

SPF stands for Sender Policy Framework. It is a DNS-based email authentication record that helps receiving mail servers check which servers are allowed to send email for a domain.

Domain owners publish an SPF record as a TXT record in DNS. When an email arrives, the receiving server can compare the connecting mail server against that policy to see whether it appears authorized to send mail for the domain.

Why It Is Used

SPF is commonly used to reduce spoofing and help receiving servers identify mail that claims to come from a domain but was sent from an unauthorized source.

It is one of the building blocks of modern email authentication alongside DKIM and DMARC. On its own, SPF is useful, but it is usually strongest when those controls are used together.

How It Goes Wrong

SPF records often become problematic as services are added over time. Vendor instructions are copied in, old platforms are left behind, nested includes accumulate, and flattened IP ranges can become stale.

Common failure points include duplicate SPF records, too many DNS lookups, broken include or redirect targets, deprecated ptr use, overly broad IP ranges, and omitting systems that genuinely send mail for the organization.

Why SPF Problems Matter

If an SPF record is incorrect, incomplete, or invalid, legitimate email may fail authentication checks. That can lead to delivery problems, junk-folder placement, filtering, or outright rejection by some receiving systems.

Common issues include too many DNS lookups, multiple SPF records, broken include targets, invalid syntax, or leaving out systems that are genuinely allowed to send mail for the domain.

What This Tool Does

This site expands nested include and redirect chains, estimates lookup counts by branch, highlights void or broken DNS lookups, detects suspicious mechanisms, and warns about flattening and broad IP ranges where relevant.

It is intended as a troubleshooting and analysis aid. Results should always be independently checked before any production DNS or email changes are made.

Relevant RFCs

These specifications define the core standards behind the checks on this site.

RFC 7208 - Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1

Common Problems Checked

Duplicate SPF TXT records at the root domain
Nested includes or redirects that exceed the 10 DNS lookup limit
Broken include, redirect, mx, a, exists, or deprecated ptr lookups
Permissive +all, neutral ?all, or multiple all mechanisms
Very long flattened records, broad IP ranges, or stale provider IPs

Improve Delivery

This site lets you check your SPF configuration - you can also check the DKIM and DMARC records on their own or all in one go at AUTHPROBLEM.com. Correct sender authentication is very important, but it is also only a starting point. For more information and practical tips on improving email delivery, visit Outgoing.email.

Questions or Issues

If you spot something that looks wrong, have a suggestion, or want to share details of a problem with one of the checks, please contact us.