Why does SPF have a 10 lookup limit?

SPF is evaluated during SMTP delivery, so the standard limits DNS-querying mechanisms to protect receivers from expensive or recursive DNS work.

Do ip4 and ip6 mechanisms count as SPF DNS lookups?

No. Direct ip4 and ip6 mechanisms do not add DNS lookups. Mechanisms such as include, a, mx, ptr, exists, and redirect do.

Is SPF flattening always better?

Not always. Flattening can reduce DNS lookups, but flattened IP ranges can become stale if a provider changes its sending infrastructure.

SPFPROBLEM.comSPF Record Analysis

SPF Syntax

This page explains the main SPF elements, qualifiers, and mechanisms that appear in SPF records.

Element	What It Does
`v=spf1`	Marks the TXT record as an SPF policy.
`ip4`	Authorizes a specific IPv4 address or CIDR range to send mail.
`ip6`	Authorizes a specific IPv6 address or CIDR range to send mail.
`a`	Authorizes the IPs returned by the domain's A or AAAA records.
`mx`	Authorizes the IPs of the domain's MX hosts.
`include`	Imports another domain's SPF policy.
`redirect`	Replaces the current policy with another domain's SPF policy.
`exists`	Matches if a DNS lookup on the given name returns any record.
`ptr`	Matches based on reverse DNS. Deprecated and generally discouraged.
`all`	Catch-all mechanism, usually placed at the end of the record.

Qualifier	Meaning	Typical Result
~	SoftFail (probably not allowed)	Accept but mark suspicious
-	Fail (not allowed)	Reject
+	Pass (allowed)	Accept
?	Neutral (no policy)	Accept, no SPF signal

+ and ? should generally not be used in modern SPF records.

v=spf1 include:_spf.example.net ~all

A common provider include pattern. The include consumes one SPF DNS lookup, plus any nested lookups used by the provider record.

v=spf1 ip4:203.0.113.10 include:mail.example.net -all

Authorizes one fixed IPv4 sender and one provider include, then asks receivers to fail non-matching senders.

v=spf1 redirect=_spf.example.net

Delegates SPF policy to another SPF record. A redirect is normally used as the final fallback rather than mixed with later mechanisms.

SPF Macros

This section explains the SPF macros that can be expanded by the receiving server during SPF evaluation.

Macro	Meaning	Typical Use
`%{i}`	Connecting IP address	Used to build per-IP DNS names in mechanisms like exists.
`%{s}`	Envelope sender	Expands to the full sender address used during the SMTP transaction.
`%{l}`	Local part of sender	The part of the envelope sender before the @ symbol.
`%{o}`	Sender domain	The domain part of the envelope sender address.
`%{d}`	Current domain	The domain currently being evaluated in the SPF record.
`%{h}`	HELO/EHLO domain	The hostname the sending server announced in HELO or EHLO.
`%{v}`	IP version	Expands to in-addr for IPv4 or ip6 for IPv6.

SPF macros are expanded by the receiving server at evaluation time. The mechanism stays the same, but the placeholder is replaced with data such as the connecting IP, sender address, current domain, or HELO host before the DNS lookup is made.