Why is SPF limited to 10 DNS lookups?

RFC 7208 limits DNS-querying terms to protect receivers from expensive or abusive policies. Exceeding the limit can cause a permanent SPF error.

Why is the lookup count different from the number of include terms?

Each include can contain more include, a, mx, ptr, exists, or redirect terms. The analyzer recursively counts the complete worst-case path, not just the root text.

Can this tool prove whether a specific IP passes SPF?

Not in this version. It audits policy structure without a sender IP, HELO name, or MAIL FROM address. Macro-dependent and message-specific evaluation needs those inputs.

gmail.com — SPF Analysis Report

A server-rendered analysis of the domain's current SPF policy, recursive dependencies, DNS lookup budget, and structural risks.

SPF results for

gmail.com

Checked: 2026-07-29T18:48:31Z

Warning

Potential DNS lookups: 1 / 10
Observed void lookups: 0 / 2
Dependency depth: 1

The 10-lookup count is a static worst-case evaluation of include, a, mx, ptr, exists, and redirect. Void results are counted only for include/redirect TXT dependencies that can be expanded without sender context.

Diagnostic findings

Warning

SPF ends with softfail

~all marks unauthorized senders as suspicious but does not state a hard failure. Use it while validating sources, then consider -all.

_spf.google.com · ~all

SPF dependency tree

Policies reached through include and redirect are shown in evaluation order. Direct lookup count is the number of DNS-querying terms in that individual record.

gmail.com

Root policy · Direct lookups: 1

Pass

v=spf1 redirect=_spf.google.com

↳ _spf.google.com

Reached through redirect · Direct lookups: 0

Pass

v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all

Frequently asked questions

Why is SPF limited to 10 DNS lookups?: RFC 7208 limits DNS-querying terms to protect receivers from expensive or abusive policies. Exceeding the limit can cause a permanent SPF error.
Why is the lookup count different from the number of include terms?: Each include can contain more include, a, mx, ptr, exists, or redirect terms. The analyzer recursively counts the complete worst-case path, not just the root text.
Can this tool prove whether a specific IP passes SPF?: Not in this version. It audits policy structure without a sender IP, HELO name, or MAIL FROM address. Macro-dependent and message-specific evaluation needs those inputs.