Bulk SPF lookup counter: which of these domains are over SPF's 10-lookup limit?
In short: Paste domains and see, for each, how many DNS lookups its SPF record costs out of 10, the includes that cost the most, void lookups and faults that make SPF fail. Limit: It counts what DNS returns now; providers can change their includes later.
A bulk SPF lookup counter expands every domain's SPF record the way a receiving mail server does and counts the DNS lookups it costs. RFC 7208 caps that at 10; past it SPF returns permerror and fails. Paste up to 100 domains (500 after a Google sign-in): each gets Within limit, Near the limit, Over 10 lookups, Broken or No SPF record, with its heaviest includes.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
Sample result
initech.example's SPF needs 13 DNS lookups, over the limit of 10, so SPF fails.
- Domain
- initech.example
What this means for you
Find the sending domains one include away from failing SPF, and the includes to cut.
- Lookups counted as a receiver counts them
- Near-limit domains flagged at 8 or more
- Heaviest includes and void lookups shown
- 100 domains a run, 500 when signed in
- SPF
- 10 lookups
- permerror
By SimpleVerifier Team · Last updated
Managing SPF for many sending domains or clients?
- Over 500 domains? Run them in batches of 500 when signed in and download the CSV after each.
- For a domain over the limit, drop includes you no longer send through, or flatten with the SPF flattener.
- Sending from these domains? Check the recipient list at /verify. The first 100 email checks are free with a Google sign-in, no card.
How do I count SPF lookups for many domains?
- Paste domains or email addresses, one per line: up to 100 a run, or 500 after a free Google sign-in. Addresses are trimmed to the domain.
- Press Count lookups. Each SPF record is read from DNS and every include, redirect, a, mx, ptr and exists term expanded and counted.
- Read each domain's count out of 10, the three includes that cost the most, and any faults: two records, void lookups, +all or unknown terms.
- Download the CSV, then open a domain in the SPF lookup counter for the full tree or flatten it with the SPF flattener.
Example
- You enter
- Three domains:
acme.example,globex.exampleandinitech.example. - You get
acme.exampleWithin limit: 4 of 10 lookups.globex.exampleNear the limit: 9 of 10, the heaviest include is a CRM's at 4 lookups.initech.exampleOver 10 lookups: 13, so SPF returns permerror and fails. Each row lists its three heaviest includes; download the CSV.- Limits
- Up to 100 domains a run without an account and 500 when signed in with Google. DNS lookups only.
What counts towards the 10-lookup limit?
RFC 7208 section 4.6.4 counts every term that makes the receiver query DNS: include, a, mx, ptr, exists and the redirect modifier, including those inside each included record. ip4, ip6 and all cost nothing. More than 10 and the check ends in permerror, which receivers treat as an SPF fail, and DMARC can then fail for mail that only passes on SPF.
The same section limits void lookups, ones that return no answer or NXDOMAIN, to two. Each row shows both counts.
Why is a domain near the limit?
Each email or marketing service adds an include, and some of those includes nest several more. A domain at 8 or 9 is one new tool away from failing, so the checker flags it. The heaviest-includes column shows which ones to remove, replace with ip4 and ip6 ranges, or move to a subdomain that sends that mail.
Who uses this tool, and for what?
- Agencies
- Find every client domain whose SPF fails from too many includes.
- Cold emailers
- Check all sending domains before adding another tool's include.
- IT teams
- Audit SPF across company domains, subsidiaries and brands in one run.
- Deliverability consultants
- Triage a new client's domains by lookup count before a fix.
What can’t this tool tell you?
- It counts what DNS returns now; providers can change their includes later.
- Macros in exists and include terms can't be expanded without a real sender and are counted, not followed.
- It doesn't check DKIM or DMARC; use the bulk email authentication checker for those.
- Up to 100 domains a run without an account and 500 signed in.
Common questions
- What does the single-domain SPF lookup counter add?
- The full tree of every nested include and its own count. The bulk counter uses the same expansion and findings, and shows the top-level summary per domain.
- Does mx count as one lookup?
- It counts as one towards the 10, and RFC 7208 also limits the MX hosts it may resolve to 10.
- Why does my count differ from another tool?
- Includes change when providers edit their records, and some tools skip nested or void lookups. This one follows RFC 7208 and counts what DNS returns at the moment of the check.
- Is anything sent to the domains?
- No email is sent. It's DNS TXT and A/MX lookups only.
- Can I paste email addresses?
- Yes. Each address is trimmed to its domain and duplicates are dropped.
- Is the bulk SPF lookup counter free?
- Yes, it's a free tool with no card. 100 domains a run, or 500 after a free Google sign-in.
Sources
You audited one domain. Cold outreach means thousands.
This tool checks a domain you type in. It will not tell you which addresses at that domain are real.
- Bulk mailbox verification with real SMTP checks
- The email finder — name plus company to a verified address
- Website enrichment for emails, owner names and socials
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.