SPF allows at most 10 DNS lookups while a receiver checks your record (RFC
7208). Every include:, a, mx, ptr, exists: and redirect= costs
one, and so does every term inside the records they pull in. Go over and SPF
fails with a permanent error, so your real email can land in spam.
Enter your domain and Nameward follows every include, counts the lookups and tells you where you stand.
What the results mean
| Lookups | Status |
|---|---|
| Up to 8 | ● Fine |
| 9–10 | ▲ Watch: the next tool you add will break it |
| More than 10 | ■ Act now: SPF fails today |
It also flags a missing SPF record and more than one v=spf1 record, which
is its own permanent error.
Getting back under 10
Remove senders you no longer use, move bulk email to a subdomain with its own
record, drop a, mx and ptr unless you need them, and only flatten
includes if something keeps the result up to date. Step by step:
SPF too many DNS lookups.
Next
SPF on its own doesn't stop spoofing; DMARC does: DMARC checker.