SPF checker & lookup counter

SPF allows a maximum of 10 DNS-lookup mechanisms — include, a, mx, ptr, exists and redirect each count as one. Exceed 10 and receivers return a PermError, which can fail your SPF entirely. This tool counts the lookups in your record and flags when you're near or over the limit.

Almost always because the record (often through nested include: statements) resolves to more than 10 DNS-lookup mechanisms. The fix is to remove unused includes, consolidate senders, or flatten the record to ip4/ip6 entries, which don't count toward the limit.

It counts the lookup-incurring mechanisms in the record you give it. Each include: can itself pull in more lookups from the provider's record, so the real total can be higher. Treat this count as the floor, and remove includes you don't need.

Use -all (hardfail) once you're confident every legitimate source is listed — it tells receivers to reject mail from anything else. Use ~all (softfail) while testing. Avoid +all entirely: it authorizes the whole internet to send as your domain.