SPF flattening and the 10-lookup limit

SPF lets a receiver make at most 10 DNS lookups while checking your record (RFC 7208 §4.6.4). Past that, the check ends in a permanent error and SPF fails for every message. Hosted SPF resolves your providers to their addresses and publishes the result, so the providers it flattens cost one lookup between them.

How a record runs out of lookups

Every include:, a, mx and redirect= costs a lookup, and so does every one nested inside an include. Those nested records belong to your providers, not to you, so the total moves when a provider restructures its record. A typical record:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:servers.mcsv.net include:sendgrid.net ~all

That is four includes, but Google's and Microsoft's records include further records of their own. The SPF page shows the real count your apex record costs today, out of 10.

What hosted SPF does

1. Flattens. We follow each include down to its ip4: and ip6: ranges. A flattened provider such as Mailchimp (servers.mcsv.net) or SendGrid (sendgrid.net) becomes a list of addresses that costs no lookup of its own.
2. Re-resolves on a schedule. Every hour the worker takes the next batch of hosted domains (50 per pass, the ones refreshed longest ago first), re-resolves their providers, and republishes a record only when its addresses changed.
3. Refuses a broken result. A result with no addresses, one that collapses below half of the published addresses, or one over the 10-lookup limit is held, and you are alerted. See Updates we hold back.
4. Splits long records correctly. A TXT record over 255 bytes is published as the several strings DNS requires.

Records are published to our zone in AWS Route 53. Resolvers that cached the previous answer pick up a change within the record's 300-second TTL.

Providers that cannot be flattened

Salesforce, SparkPost and Elastic Email authorize mail with exists:, which asks DNS about the sending address itself at the moment of the check. There is no list of addresses to flatten. Hosted SPF keeps these providers in your record as a pass-through include:, so receivers check them as before. Each costs its own lookups, which the page counts against your 10.

The ending: ~all or -all

• ~all (softfail) asks receivers to treat mail from unlisted sources as suspect; most file it as spam rather than refuse it. Start here.
• -all (fail) asks receivers to refuse it. Move here once your DMARC reports show every legitimate sender passing.

Who sets the ending depends on the mode you chose when moving your SPF.