Orbit web apps
Orbit web apps
Paste an SPF record and count the DNS lookups it costs against the limit of 10 — the failure that quietly breaks SPF. Runs entirely in your browser.
Paste the TXT record value. Look it up with dig TXT example.comor your DNS host's dashboard. Nothing is sent anywhere — it is parsed in your browser.
Paste a record to count its lookups against the limit of 10.
The 10-lookup ceiling is RFC 7208 §4.6.4 — indicative of how every compliant receiver behaves, not a per-provider setting. Past it, SPF returns a permerror and stops authenticating you. SPF, DKIM & DMARC explained has the full walkthrough.
SPF fails far more often from too many DNS lookups than from a wrong IP. Every include, a, mx, ptr and exists term costs a receiver one DNS query, and once evaluating your record would cost more than ten, the receiver gives up with a permerror — which means SPF stops authenticating you at all. Most senders cross that line without ever seeing an error, because nothing in their inbox tells them.
RFC 7208 requires every receiver to abandon SPF evaluation once it would cost more than ten DNS lookups, returning a permerror. A permerror is not a soft warning — it is treated as no usable SPF result, so mail that should have passed loses its SPF authentication. For a domain leaning on SPF for DMARC alignment, that can quietly demote a whole lifecycle programme to the spam folder.
The terms that count are include, a, mx, ptr and exists, plus the redirect modifier — one lookup each. The ones that are free are ip4, ip6, all and exp. That asymmetry is the whole game: every SaaS you add as an include spends a lookup, while the same senders expressed as ip4 ranges spend none.
An include points at another domain's SPF record, and that record has its own includes, which have their own — the cost compounds through a tree you cannot see without live DNS. A single include:_spf.google.com counts as one lookup here, but resolving it fully has historically cost several. This checker counts only the terms in front of it, so the number it shows is a guaranteed minimum.
The practical rule that follows: leave headroom. If the visible count is already eight or nine, one popular include can tip you over on its own, and you will not find out from a bounce — you find out from a slow decline in delivery that is hard to trace back. Treat anything from eight up as a record that needs trimming before it needs another sender.
The first pass is deletion: old ESPs, a trial tool you evaluated once, a payment provider you no longer use. Each stale include is a lookup spent on mail you do not send. Auditing who actually sends as you — which is exactly what DMARC aggregate reports show you — usually reclaims two or three lookups immediately.
After that, flatten what is stable. A sender with fixed IPs can be expressed as ip4/ip6 ranges directly in your record, which costs zero lookups instead of one per include. And you can move a class of sending — bulk marketing, say — onto a subdomain like mail.yourdomain.com with its own SPF record and its own fresh budget of ten, which also isolates its reputation from your main domain.
The all mechanism at the end of the record is the default answer for every sender you did not explicitly authorise, and its qualifier is the whole point. -all (fail) tells receivers to reject them; ~all (softfail) tells them to accept but mark; ?all (neutral) asserts nothing; and +all authorises everyone, which disables SPF entirely. A bare all with no qualifier means +all — the most dangerous value, reached by accident.
The sane path is ~all while you are still discovering your legitimate senders, then -all once the record is complete and you have confirmed nothing legitimate is left out. ?all and +all are not stances, they are the absence of one: a record ending that way passes an audit for existing but protects nothing.
A domain may publish exactly one SPF record. Two v=spf1 TXT records — a common result of two teams each adding their own — is a permerror at every receiver, the same hard failure as blowing the lookup limit. If you need to authorise more senders, you merge the mechanisms into a single record; you never add a second.
And drop ptr if you still have it. RFC 7208 explicitly discourages it: it is slow, unreliable, ignored or penalised by some receivers, and it still spends one of your ten lookups. Anything ptr was authorising can be expressed with a, mx or ip4/ip6 instead — which are faster, more predictable, and in the ip case, free.
Built into Orbit
Orbit's deliverability tooling reads a domain's live SPF, DKIM and DMARC and flags the gaps before a send — including resolving nested includes to give you the true DNS-lookup count this browser-only tool can only floor. Claude can walk you from a bloated record to one comfortably under the limit.
Sign up free