Find what is eating
your SPF budget.

SPF permits a maximum of ten DNS lookups when a record is evaluated. Every include, a, mx, ptr, exists and redirect counts — including the ones nested inside records you include. Exceed ten and the result is permerror, which most receivers treat as a failure.

This is the failure mode that bites in practice, because each provider you add costs one to three lookups. A company using an ESP, a CRM, a helpdesk and a payroll tool can quietly pass the limit and find out months later.

Flattening — replacing includes with raw IP addresses — is sold as a paid service almost everywhere. It works, and it goes stale the moment your provider rotates IPs, which is precisely why it is sold as a hosted subscription rather than a one-off. Fixing the chain is usually better than flattening it.

One limitation, shared by every SPF tool: an exists: mechanism containing an %{i} macro is counted but cannot be expanded, because the sender IP is unknown outside a real delivery.