An SPF record, and a real count of what it costs you.
Pick the services you send with. The record assembles as you go, and the counter shows what each include costs — including the lookups inside it, which is where most records quietly go over the limit.
Literal addresses cost no lookups at all, which is why they are the way out of a crowded record.
v=spf1 mx include:_spf.google.com ~all
Within the limit. The range is a range because published figures for the same include disagree — a live resolution is the only authoritative count.
Most generators count one lookup per include. That is not how it works.
An include: pulls in the other domain’s whole record, and its includes count against your ten as well. Google Workspace alone is three or four; Salesforce is three. A record with both is already six or seven before you have added your own servers.
The figures are a range because published sources disagree, and because vendors change their own records without announcing it. A generator that shows one confident number is guessing at your expense — the only authoritative count is a live resolution of the record as published.
Four ways out, in the order worth trying.
Over ten lookups, receivers return PermError and SPF fails — for every message, including the legitimate ones. It is not a warning state.
Delete what you no longer use
The commonest cause of a bloated record is a service you stopped paying for two years ago. Aggregate reports tell you which includes are still carrying real mail.
Split streams across subdomains
Send marketing from news.example.com and billing from billing.example.com. Each subdomain gets its own record and its own budget of ten.
Replace an include with its IPs
If a vendor publishes a stable, documented set of addresses, listing them as ip4: costs zero lookups. Only for vendors who commit to their ranges.
Flattening services
These resolve your includes and republish the result as literal IPs, refreshed for you. It works, and it makes your mail delivery depend on a third party keeping their record current. DDMARC's own is on Professional: a flattened record hosted by us, kept inside the ten-lookup limit as your providers change theirs.
Frequently asked questions.
SPF allows a maximum of 10 DNS lookups across the whole record, including every lookup inside a nested include: entry. Exceeding the limit returns a PermError, and receivers treat the record as if no SPF existed at all, for every message.
No. Only mechanisms that trigger their own DNS query, such as include:, a, mx, ptr, and exists, count toward the 10-lookup limit. Listing raw addresses with ip4: or ip6: costs nothing against it.
No. A domain may publish only one SPF TXT record. Two or more records make SPF invalid for that domain, so combine every sender into a single record.
The receiving server returns a permanent error (PermError) and fails SPF for every message, not only the ones that pushed the record over. Reduce lookups by removing unused include: entries, swapping them for ip4:/ip6: ranges where possible, or flattening nested includes.
For the full walkthrough, see the SPF setup guide.
DMARC Report Analyzer
Paste or upload a DMARC aggregate (RUA) report and see total volume, pass/fail rates, and which senders are failing. Runs in your browser.
DMARC Record Generator
Create a valid DMARC record for your domain. Configure policy, reporting emails, and advanced options.
DKIM Key and Record Generator
Generate a DKIM key pair in your browser and get the TXT record to publish. The private key never leaves your device.
MTA-STS Record and Policy Generator
Build the _mta-sts TXT record and the mta-sts.txt policy file together, with MX patterns and max_age checked.
TLS-RPT Record Generator
Build the _smtp._tls record that asks senders to report failed TLS connections, with email and https destinations checked.
SPF Checker
Look up a domain's SPF record, walk every include, and count DNS lookups against the limit of 10.
Domain Checker
Check your domain's email authentication setup. See your SPF, DKIM, DMARC, and MTA-STS configuration.
DMARC Checker
Look up any domain's DMARC record and get every tag explained — policy, alignment, reporting, and coverage.
DKIM Checker
Check a domain's DKIM record by selector. See the key type, size, and each tag, with quick-picks for common providers.
MTA-STS & TLS-RPT Checker
Check a domain's MTA-STS policy record and TLS-RPT reporting — the pair that forces inbound mail over TLS.
BIMI Checker
Look up a domain's BIMI record, preview the logo, and confirm the VMC and DMARC enforcement it requires.
SPF is one of three, and the weakest alone.
SPF authorizes servers. It says nothing about the From: address a recipient reads — that is DMARC’s job, and it is the record that makes SPF worth having. Once it asks for reports, Monitor reads them for 2 domains at no charge and shows which senders fail.