SPF Optimization: How to Stay Under the 10-Lookup Limit Without Dropping Providers

Last year I audited an SPF record for a company that used eight different email providers. Eleven includes in one record. They had no idea half their outbound mail was silently bouncing. The 10-lookup limit sneaks up on you faster than you think.

The limit comes from RFC 4408 and it's still in RFC 7208. The reasoning was that SPF checks should complete quickly so they don't delay email delivery. In practice, every company that adds more than a couple of email providers eventually hits this wall.

Here's what counts as a lookup:

Each include: mechanism - 1 lookup

Each a: mechanism (even if the domain resolves to multiple IPs) - 1 lookup

Each mx: mechanism - 1 lookup

Each exists: mechanism - 1 lookup

Each ptr: mechanism (don't use this, it's deprecated) - 1 lookup

Here's what does NOT count:

ip4: and ip6: mechanisms - 0 lookups

The all mechanism at the end - 0 lookups

The a: and mx: mechanisms for the checked domain itself - 0 lookups (these are already resolved during the SPF check)

Auditing Your Current Record

First, check what you have. Use our SPF Lookup tool to query your domain's SPF record. It returns the full record and counts the lookups.

Here's a real-world example I see all the time:

v=spf1 mx include:_spf.google.com include:spf.protection.outlook.com 
include:sendgrid.net include:spf.mandrillapp.com 
include:spf.mailchimp.com include:amazonses.com 
include:_spf.salesforce.com include:mail.zendesk.com 
include:servers.mypobox.com include:spf.constantcontact.com -all

That's 11 includes plus mx. Total: 12 lookups. PermError on any receiving server that counts correctly.

Optimization Techniques

1. Replace Includes With IP Ranges

This is your most powerful tool. Instead of including a provider's entire SPF record (which may have its own includes), resolve it yourself and use ip4: entries.

SendGrid example:

Before:

include:sendgrid.net

This triggers a lookup and follows the entire SendGrid SPF chain. SendGrid's current SPF includes multiple IP ranges internally.

After resolving it:

ip4:167.89.0.0/17 ip4:208.117.48.0/20

Zero lookups. The trade-off: you need to monitor SendGrid's published IP ranges and update yours if they change.

2. Consolidate Providers

If you're using multiple providers that offer similar services, consolidate to one. One include is cheaper than three. This isn't always practical, but I've seen companies running Google Workspace, Office 365, and Zoho simultaneously. Pick one.

3. Remove Dead Providers

This sounds obvious, but I've audited SPF records and found includes for:

A CRM they stopped using in 2019.

A marketing platform that went out of business.

An old web host they migrated away from.

A transactional email service they replaced two years ago but never removed.

Every dead provider is a wasted lookup. Audit your includes annually.

4. Use the mx Mechanism

If your email servers share the same domain suffix, use mx instead of listing individual IPs:

Before:

ip4:203.0.113.1 ip4:203.0.113.2 ip4:203.0.113.3

After:

mx

The mx mechanism counts as one lookup regardless of how many MX records you have.

5. Subdomain Delegation

If you absolutely cannot fit under 10 lookups, split your email into subdomains:

mail.example.com - employee email

marketing.example.com - marketing campaigns

transact.example.com - transactional emails

Each subdomain gets its own SPF record with its own 10-lookup budget. This is more work to set up but solves the limit permanently.

Example: Before and After

Here's a typical company with 5 email providers:

Before (8 lookups - under limit but already getting tight):

v=spf1 mx include:_spf.google.com include:spf.protection.outlook.com 
include:sendgrid.net include:spf.mandrillapp.com 
include:spf.mailchimp.com -all

Lookups: mx(1) + google(1) + outlook(1) + sendgrid(1) + mandrill(1) + mailchimp(1) = 6 (plus the implicit lookup for the domain itself)

Optimized (3 lookups):

v=spf1 mx include:_spf.google.com include:spf.protection.outlook.com 
ip4:167.89.0.0/17 ip4:208.117.48.0/20 
ip4:198.2.128.0/18 ip4:205.201.128.0/20 -all

Replaced SendGrid, Mandrill, and Mailchimp includes with their IP ranges. Saved 3 lookups.

Using the SPF Generator

Our SPF Generator helps you build optimized records. The UI gives you templates for common providers, a qualifier dropdown, and a custom mechanisms field. The generator counts lookups in real time and warns you when you're approaching the limit.

What Happens If You Go Over

Every MTA handles this differently. Some reject the email immediately with a PermError. Some treat it as a softfail. Some try to process as many mechanisms as they can within the limit and ignore the rest.

The safest assumption: if you hit 11 lookups, some of your email is going to be rejected. Fix the record.

Verify Your Optimization

After publishing your optimized SPF record:

Use the SPF Lookup tool to check the record and verify the lookup count.

Use the DNS Propagation Checker to confirm it's visible globally.

Send a test email and check the headers for the SPF result.

If the SPF result is "pass" and the lookup count is under 10, you're good. If you see "PermError" in the headers, you're still over the limit.