Free email tool
When an SPF record needs more than 10 DNS lookups, receivers treat it as a permanent error and SPF fails. See what each include costs, and get a flattened record that needs far fewer lookups.
Instant result, no email needed.
Flattening replaces includes with the IP addresses they resolve to today. It fixes the lookup limit, but providers change their IP ranges without notice, so a flattened record goes stale and starts failing legitimate mail. The safer order: remove includes for services you no longer use, move some senders to a subdomain, and flatten only what is left. Includes that cannot be expanded (macros, exists, ptr) are kept as they are and shown.
To see the full include tree and every SPF issue, use the SPF Record Checker; to build a record from scratch, the SPF Record Generator.
RFC 7208 caps the DNS-querying mechanisms (include, a, mx, ptr, exists and redirect) at 10 per evaluation, so a single message cannot make a receiver do unbounded DNS work. Exceeding it is a permanent error: SPF fails for every message.
Only while the provider's IP ranges stay the same. Google, Microsoft, SendGrid and others change theirs without notice. Re-check regularly, or flatten only the includes that rarely change and keep the big providers as includes.
A flattened record can exceed the safe size for one DNS answer. It is then split into sub-records that the main record includes. Each costs one lookup, still far below 10.
If any include could not be read, a flattened record would be missing addresses and would block real mail, so none is produced. Run the check again later.
Add your domain to CloudSpex to be alerted when SPF breaks or its lookups creep back up.
Start Monitoring Free