Mail Domain Check
Live public DNS
SPF lookup counter
Expand the current include and redirect chain, count DNS-causing SPF terms, and compare the observed total with the RFC limit of 10.
INPUT
Sending domain
RESULT
Lookup budget
The result distinguishes a missing or duplicate SPF policy from a complete lookup count and an observed lower bound.
- DNS-causing terms
- RFC limit
- Remaining budget
The free counter omits raw DNS records, the expanded include evidence, and remediation actions. The complete check keeps those details behind its report boundary.
RFC budget model
Count mechanisms that can trigger DNS work
Each use consumes one term from the evaluation limit. Nested include policies add their own DNS-causing terms.
A redirect target consumes budget and its policy must also be evaluated when no mechanism matched.
These terms do not count toward the section 4.6.4 DNS lookup limit, though the full policy still needs correct syntax and authorization scope.
Runtime macro boundary: an include such as include:%{ir}.%{v}.%{d}.spf.example depends on the real SMTP client IP and current SPF domain. A static DNS counter can report only the visible term and an observed lower bound; it cannot prove the receiver's final SPF result. Conversely, one receiver's SPF pass does not prove that a product's separately configured literal include: target is present.
Primary references: RFC 7208 SPF DNS lookup limits, RFC 7208 macro expansion, and Google Workspace SPF troubleshooting.