Why is there a limit of 10 DNS lookups?

RFC 7208 caps the lookups a receiver will perform while evaluating one SPF record, to stop SPF being used as a denial-of-service amplifier. Include, a, mx, ptr, exists and redirect each cost one, and nested includes add theirs. Past 10, the result is permerror and SPF fails for every message.

Is ~all or -all better?

-all tells receivers to reject mail from unlisted servers outright. ~all asks them to accept but mark it. With DMARC in place both count as a failure, so ~all is a safe default and -all is the stricter end state.

What is a void lookup?

An include or redirect that points at a name with no SPF record. RFC 7208 allows at most two per evaluation before the record is treated as an error.

SPF checker

SPF (Sender Policy Framework) is a DNS record that lists which servers are allowed to send mail for a domain, so receivers can reject mail from servers not on the list. This tool fetches the record, walks every include, and counts DNS lookups against the limit of 10 before a receiver does it for you.

What this tool checks

It fetches every TXT record at the domain, keeps the ones beginning v=spf1, and parses each term. It then follows every include: and redirect= recursively, adding up the DNS lookups the way a receiving server would, and reports the total against the limit of 10 from RFC 7208.

Common results and what to do

Too many lookups. Remove includes for services you no longer use, or replace an include with the provider's IP ranges as ip4: and ip6: terms. Automated "flattening" works but needs re-running when the provider's ranges change.
Multiple records. Merge them into one. Two SPF records is a permanent error, not a union.
+all. Anyone can send as you. Change it today.

SPF and rejection at the handshake

SPF is evaluated from the MAIL FROM command, which arrives before any message content. That timing is why Spamjadoo can apply it as a rejection during the SMTP session rather than a score after delivery, so the sender gets a 550 and the message is never accepted.

Questions people ask

Why is there a limit of 10 DNS lookups?: RFC 7208 caps the lookups a receiver will perform while evaluating one SPF record, to stop SPF being used as a denial-of-service amplifier. Include, a, mx, ptr, exists and redirect each cost one, and nested includes add theirs. Past 10, the result is permerror and SPF fails for every message.
Is ~all or -all better?: -all tells receivers to reject mail from unlisted servers outright. ~all asks them to accept but mark it. With DMARC in place both count as a failure, so ~all is a safe default and -all is the stricter end state.
What is a void lookup?: An include or redirect that points at a name with no SPF record. RFC 7208 allows at most two per evaluation before the record is treated as an error.