SPF DNS lookup counter

Count how many of the 10 permitted DNS lookups a domain's SPF record uses, with the full include tree.

Free, instant, no signup. Results include SPF, DKIM and DMARC together.

Why 10 lookups matters

RFC 7208 section 4.6.4 limits SPF evaluation to 10 DNS-querying mechanisms, counted across the whole include tree. Exceeding it produces permerror, which most receivers treat as SPF fail. Because each vendor include may itself contain several includes, a record that looks short (include:_spf.google.com include:sendgrid.net include:spf.protection.outlook.com …) often uses 8 to 12 lookups.

This tool shows the resolved tree so you can see which include costs the most, and whether any include is void (points at a domain with no SPF record), which has its own limit of 2.

Read the guide: fixing SPF too many DNS lookups.

Ways out of a bad result

Remove what you stopped using. Most records over the limit include a tool that was cancelled years ago.

Flatten the noisy ones. Swap a heavy include for its IP ranges, and monitor them.

Use subdomains. Send marketing from a subdomain with its own SPF and stop crowding the root.

Monitoring re-counts this every day, so the next include someone adds does not sneak past 10.

Recently graded

Public checks from the last few days. Every report is re-measured from DNS when opened.

live

DomainSPFDKIMDMARCGrade

gandi.net2 lookupsnot foundp=noneC zoom.us6 lookups2048-bitp=rejectA skype.com2 lookupsnot foundp=rejectB shopify.com4 lookups2048-bitp=rejectA bing.com1 lookupsnot foundp=rejectB ebay.com10 lookups2048-bitp=rejectA facebook.com1 lookupsnot foundp=rejectB msn.com7 lookups2048-bitp=noneB