Defaults.Exposed › Tools › SPF lookup counter: expand your record and count what a resolver sees
SPF lookup counter: expand your record and count what a resolver sees
The record in your DNS panel and the tree a receiving server walks are two different objects. You publish four lines; the receiver resolves whatever those four lines pull in, charges one DNS lookup for each term that needs one, and gives up at ten. Type a domain below and this counts the resolved total the way RFC 7208 says a receiver counts it, with each include priced separately.
Past ten lookups the receiver returns PermError and discards the evaluation. PermError voids the whole record, so a sender you listed correctly on line one is treated exactly like one you never listed.
Of the 150,103,209 domains publishing an SPF record in the September 2026 census, the edition flagged 7,408 for too many lookups. That count is a floor, because the census reads the declared record rather than resolving each include chain, so a record that only spills past ten once its includes expand is not in it. The gap between the declared record and the resolved one is the reason this page takes an input instead of quoting a number at you.
The chain is resolved here, over this server's own resolver, and the walk stops after five seconds.
What each term costs
The cost is per occurrence and the total is for the whole evaluation, top to bottom, with includes expanded. Count against this if you want to check the tool.
| Term | DNS lookups | Note |
|---|---|---|
include: | 1, plus everything inside it, recursively | Where nearly every blowout starts. One line in your panel can cost five once it resolves. |
redirect= | 1, plus the target record's own terms | Charged like an include, and easy to miss because it sits at the end. |
a | 1 each | Even a bare a for your own domain. |
mx | 1 each | The MX query itself. The address lookups for the hosts it returns have their own separate ceiling of ten. |
exists: | 1 each | Rare outside macro-driven records. |
ptr | 1 | Deprecated since RFC 7208. Delete it rather than budget for it. |
ip4: and ip6: | 0 | This is why flattening lowers the count. |
-all, ~all, ?all | 0 | The qualifier is free, and it only applies to a record that evaluates. |
The second limit nobody mentions
The same section of the RFC caps void lookups at two. A void lookup is a query that comes back with nothing, which is what an include pointing at a service you cancelled two years ago produces. Two of those void the record on their own, before the ten-lookup count comes into it, so the counter reports them separately.
What this tool does not do
It charges one lookup for an mx term and does not walk the address lookups for the hosts
that term returns, which have their own ceiling inside it. It counts a macro-carrying
exists: term without resolving it, because the name that term queries depends on the
message rather than on your zone. And the walk stops after five seconds, in which case the answer says
so and the number it gives you is a floor.
Read next
What SPF is and what it protects · SPF PermError: getting back under ten · When a SaaS sender fails SPF
Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.