Free tool
Does your SPF record exceed ten lookups?
This tool resolves your SPF record recursively and counts the DNS queries it costs. RFC 7208 allows ten; past that, evaluation stops with a permerror and the record stops protecting the domain, with nothing visibly breaking.
Only public DNS records are read, from public resolvers. No connection is opened to the domain being examined, no email is sent, and the domain you test is not kept.
What counts, and what does not
| Mechanism | Cost |
|---|---|
ip4: | 0 |
ip6: | 0 |
all | 0 |
a | 1 |
mx | 1, plus one per listed host |
include: | 1, plus the included record's cost |
exists: | 1 |
ptr | 1, and discouraged by the standard |
redirect= | 1, plus the target's cost |
The full detail, with how to get back under the limit without creating a debt, is in the guide on this limit.
Why going over is silent
Past ten, evaluation does not return “fail” but permerror. And a permerror is not a fail: most receiving servers then treat the message as though no SPF record were published at all.
No message bounces, no alert is raised, no client complains. The domain believes itself protected when it no longer is, and it can stay that way for years.