SPF lookup checker: count your DNS lookups and see which include costs most
The short answer
Type a domain. The checker reads its SPF record, follows every include and counts the DNS lookups against the limit of 10 in RFC 7208. It draws the tree with the cost of each branch, so you see which vendor uses your budget, and it flags more than one record, void lookups and an all that lets everyone send.
Check a domain now
No account, no card. The result opens in the SkyQon dashboard's free check.
Free, no account. We read only public DNS and what your servers show to anyone who connects.
What the result shows
- The count against the limit of 10, with one verdict: within the limit, close to it (9 or 10), over it (PermError), no SPF record, or could not be read.
- The include tree: one line per lookup, what it costs and what it pulled in. The branch that costs most is marked, because that is where to cut first.
- Failure cards, only when they apply: too many lookups, more than one SPF record, more than two void lookups, a template placeholder left in the record, and an all that lets everyone send.
- Your current record in a box you can copy, and the steps that fit what was found.
- “Could not be read” is never “no record”. If a DNS server does not answer, the result says the count is incomplete. It does not guess, and it does not tell you that you have no SPF.
How we count
We count the way RFC 7208 section 4.6.4 tells a receiver to, in the worst case, where every term is evaluated because the sending server matches none of them.
| Term | What it costs | Lookups |
|---|---|---|
include:x | 1, plus every lookup inside x's record | 1 + x |
redirect=x | 1, plus every lookup inside x's record | 1 + x |
a, a:x, a/24 | 1, whatever the qualifier or suffix | 1 |
mx, mx:x | 1; it may return at most 10 mail hosts | 1 |
exists:x | 1; a macro target is counted but not expanded | 1 |
ptr | 1; RFC 7208 says not to use it | 1 |
ip4:, ip6:, all, exp= | Nothing to look up | 0 |
| The same include twice | Counted each time it is reached | 2 × x |
| Limit per check (more than 2 void lookups is also a PermError) | 10 | |
A loop, where a record includes one of its own ancestors, is cut and reported instead of counted forever.
What happens past 10
- PermError, for every message. The receiver stops reading at the eleventh lookup, so none of your senders pass SPF, not even the ones listed first. RFC 7208 §4.6.4
- DMARC rests on DKIM alone. Mail that is not DKIM-signed for your domain fails DMARC and, under p=quarantine or p=reject, is filtered or refused. RFC 7489 §3.1
- Nobody tells you. Receivers do not report a PermError to the sender. You find out from DMARC reports or from customers who did not get an invoice.
Count your own record
Paste a domain, or a full address: the box keeps only the domain.
Free, no account. We read only public DNS and what your servers show to anyone who connects.
Fix it, step by step
Run the checker on your domain
Note the total and the branch marked as costliest.
Remove what no longer sends
Includes for services you left, includes another vendor's record already contains, and mx or a terms for hosts that never send mail.
Split bulk mail off
Give newsletters a return-path on a subdomain with its own SPF record and its own budget of 10.
Publish one record and check again
Keep a single v=spf1 record, end it in -all or ~all, and run the checker once more after the change has spread.
Common mistakes
Fixing the count by copying addresses
Vendor addresses change. A copied list goes stale silently and their mail starts failing your SPF.
In SkyQon's result: ip4 and ip6 terms cost 0, so a stale copy looks perfect in any checker. Keep the include.
Ending the record in +all or ?all
+all lets every server on the internet pass SPF as you. ?all says nothing at all. Use -all, or ~all while you are still finding senders.
In SkyQon's result: a permissive-all card when the record ends in +all or ?all.
Leaving a template placeholder in the record
A provider's example text such as <your-ip> published as it is means no working SPF record at all.
In SkyQon's result: a placeholder card, and the record scored as no SPF.
What SkyQon does and does not do
What it finds
SPF on the domain you type: every record it includes, the lookups each branch costs, void lookups, more than one record, placeholders and a permissive all.
What you get
A one-off count with the tree and the steps. Add the domain to the free plan and every scan recounts it, with an alert at 9 or 10 lookups and another past 10.
What it is not
We do not host, flatten or rewrite your record, and we keep no list of the domains people check. Your SPF stays yours.
SPF checker: questions people ask
Which terms count towards the limit of 10?
Does a repeated include count twice?
What is a void lookup, and why does the checker count them?
How are MX lookups counted?
Do subdomains need their own SPF record?
Why does SkyQon not host my SPF record?
Do you store the domains I check?
Can it check a record I have not published yet?
My count differs from another tool. Why?
Watch it, so a vendor's change cannot surprise you.
The free plan watches up to 5 domains. SkyQon recounts your SPF tree on every scan and alerts you at 9 or 10 lookups, before a vendor's change pushes you past 10.