Free tool

SPF Flattener & Lookup Counter

Count the DNS lookups in an SPF record and see exactly where you're burning your 10-lookup budget.

Why the 10-lookup limit breaks SPF

SPF allows a maximum of 10 DNS lookups per evaluation. Every include: costs a lookup - and worse, each included record has its own includes, so one include:_spf.google.com can quietly consume four lookups. Stack a few providers and you blow past 10, which turns your entire SPF record into a PermError.

This tool resolves your SPF record including nested includes, counts the true lookup total, and shows where the budget is going so you can decide what to remove, replace with a direct IP, or flatten.

What counts against the budget

Only some mechanisms cost a DNS lookup. Knowing which is half the battle for staying under 10.

Costs a lookupFree (no lookup)
include: (plus every nested include)ip4:
aip6:
mx (one, plus one per MX host)all
exists: and redirect=(literal IP mechanisms)

Flattening, and its tradeoff

Flattening replaces include: mechanisms with the underlying IP addresses (ip4: and ip6:), which cost zero lookups - so a record that was failing at 14 lookups can drop to well under the limit. It's the most direct fix when you genuinely need many senders.

The catch is maintenance. Providers change their sending IPs periodically, and a flattened record is a frozen snapshot - if Google or your ESP rotates IPs and your flattened record doesn't follow, legitimate mail starts failing SPF. Only flatten what you must, and revisit flattened records on a schedule.

How to fix it without flattening

Before flattening, try the cheaper fixes. Remove unused includes - audit every include: and drop any service you no longer send through. Replace small fixed-IP senders with direct ip4: entries, which cost nothing. Consolidate overlapping providers where you can.

The cleanest structural fix is subdomains: send different email types (marketing, transactional, cold outreach) from separate subdomains, each with its own SPF record and its own fresh 10-lookup budget. That often removes the pressure entirely without freezing any IPs.

Frequently asked questions

What counts toward the SPF lookup limit?

include:, a, mx, ptr, exists:, and redirect= each cost a lookup, plus every nested lookup inside included records. ip4:, ip6:, and all cost nothing.

What is SPF flattening?

Flattening replaces include: mechanisms with the underlying IP addresses (ip4:/ip6:) so they no longer cost DNS lookups. The tradeoff is you must keep the IPs updated when providers change theirs.

What happens if I exceed 10 lookups?

The SPF record returns a PermError and fails entirely - receivers treat it as if you have no valid SPF at all. That's why staying under the limit matters even if every individual mechanism is correct.

How do I fix too many lookups without flattening?

Remove unused includes, replace small fixed-IP senders with ip4: entries, consolidate providers, and split email types across subdomains that each get their own SPF budget.

Next steps

Stop configuring DNS by hand

Cladiant provisions real Google Workspace, Microsoft 365, and Azure Entra mailboxes with SPF, DKIM, and DMARC written and verified on every domain before a single message sends. No DNS headaches, no authentication gaps, one invoice.