The SPF 10-lookup limit: what each vendor's include really costs

An SPF record is a TXT record starting v=spf1 that lists who may send mail for a domain. The receiving server evaluates it on every message. IETF sets the budget:

SPF implementations MUST limit the total number of those terms to 10 during SPF evaluation, to avoid unreasonable load on the DNS.

"Those terms" are the ones that make the receiver query DNS:

The following terms cause DNS queries: the "include", "a", "mx", "ptr", and "exists" mechanisms, and the "redirect" modifier.

ip4:, ip6: and all cost nothing, because the answer is already in the record. The count runs across the whole evaluation: when the receiver follows an include:, every DNS-querying term in the included record is added to the same total. Going over is not a soft failure. The same section says that if the limit is exceeded, the implementation MUST return permerror. Receivers return permerror for any sender whose check runs past the 10th lookup; which senders that hits depends on their order in the record.

Microsoft puts the consequence plainly:

Each include: statement requires at least one DNS lookup, and more lookups might be required if the include: value points to nested resources. In other words, having fewer than 10 include: statements doesn't guarantee fewer than 10 DNS lookups.

Each value below is the one the vendor's own setup page tells you to publish. The cost is what we measured on 2026-09-23 by walking the record with the engine behind DoDomain's SPF record checker: one lookup for the include itself, plus one for every DNS-querying term inside it. Vendors change these records without notice, so check a domain's live count rather than trusting any table, this one included.

The spread is the point. Google Workspace, Microsoft 365 and Zendesk list their sending addresses directly, so their include costs one lookup. Freshdesk's include pulls in 6 more records, among them SendGrid's, and costs 7 on its own.

Two common senders need no include at all by default:

• Postmark: "It is no longer required to include Postmark in your own custom SPF record." SPF is checked against the Return-Path domain, and Postmark's is its own.
• Amazon Web Services: by default the MAIL FROM domain is a subdomain of amazonses.com, so SPF passes against Amazon's record. You add an include only when you set up a custom MAIL FROM domain.

Take a company that uses Google Workspace (1), Freshdesk (7) and Mailgun (5). That is three includes, and 13 lookups: over the limit of 10 before any a or mx term the company adds for its own servers. Mail that matches before the 10th lookup still passes, but everything the receiver can only authorise after it, here most of Mailgun's senders, now fails SPF with a permerror, and SPF validators report the whole record as broken.

Nothing warns the person who added the last include. Their DNS host accepts the record, and the failure shows up later as mail landing in spam or DMARC reports nobody reads.

• Remove what no longer sends. Old newsletter tools and trial vendors linger in SPF records for years. Each one you remove gives back its full nested cost.
• Check what actually needs an include. As with Postmark and SES above, a vendor that sends with its own Return-Path domain passes SPF against its own record. Your include adds nothing for that mail.
• Move bulk senders to a subdomain. Marketing or support mail sent from mail.example.com is checked against that subdomain's own SPF record, with its own budget of 10. Microsoft recommends subdomains for this.
• Flatten with care. Replacing an include with the ip4: ranges it resolves to costs no lookups, but freezes a list the vendor can change at any time. When they add a range, mail from it starts failing and nothing tells you. Microsoft's guide advises against doing it for Microsoft 365.

A SaaS product that sends email as its customers asks each of them to add its include to their record. Every lookup your include costs comes out of their budget, which is already shared with every other vendor they use.

• Make your include cost one lookup. Publish your sending ranges as ip4: and ip6: terms directly in the record you ask customers to include, rather than chaining to your email provider's includes. You control that record, so you can keep it current, which is exactly what a customer who flattens cannot do.
• Check the customer's count before you ask. A record already at nine lookups breaks the moment your include lands, and the customer will blame the last change. The SPF record checker walks a domain's record and counts its lookups against the limit.
• Merge, never add a second record. A domain may publish only one SPF record, and two is a permerror of its own. DoDomain's email-authentication sessions add your one include to the customer's existing record, and warn beside a record that already makes more than 10 lookups.

SPF is published as a TXT record, the same record type used to prove domain ownership. The TXT record verification entry explains how a verification token can sit beside an SPF record at the same name.

All external pages retrieved 2026-09-23. Quotes are verbatim. Lookup counts are DoDomain's own measurements from 2026-09-23.

1. IETF, RFC 7208: Sender Policy Framework (SPF), section 4.6.4. The 10-lookup limit, which terms count toward it, and the permerror result when it is exceeded.
2. Microsoft, Set up SPF to identify valid email sources for your Microsoft 365 domain. The Microsoft 365 include value, and its explanation of nested lookups.
3. Google, Set up SPF. The Google Workspace include value.
4. Zendesk, Allowing Zendesk to send email on behalf of your email domain. The Zendesk include value.
5. Zoho, SPF - Sender Policy Framework. The two Zoho include values.
6. Mailgun, Domain Verification. The Mailgun include value.
7. Freshdesk, Create an SPF record to ensure proper support email delivery. The Freshdesk include value.
8. Postmark, How do I set up SPF for Postmark?. That its include is optional, because SPF is checked against its own Return-Path domain.
9. Amazon Web Services, Authenticating Email with SPF in Amazon SES. That SES's default MAIL FROM domain needs no include in your record.