SPF lookup-budget checker
Inspect a domain's SPF syntax and recursively count DNS-triggering terms.
Your inputs
Your results
Ready when you areYour results will appear here.
How it works
Inspect SPF mechanisms and estimate the DNS-causing term budget defined in RFC 7208 section 4.6.4. Live mode reads public TXT records and follows literal include and redirect domains with caching. Mechanisms after all and redirects in records containing all are ignored. Repeated includes count on each visit even when their DNS response is cached.
A few things to know
This is a bounded policy inspector, not a complete RFC SPF evaluator or email deliverability test. It has no sender IP, MAIL FROM or HELO context, does not expand macros, and does not query A, AAAA, MX or PTR data. Unknown modifiers are ignored; invalid supported syntax is rejected. The sum across branches may exceed any realizable sender path. Cycles and macros yield an incomplete estimate; missing records, multiple SPF records and DNS failures stop analysis. Live traversal is capped at 24 TXT requests, 30 seconds, 12 levels and 100 policy visits. Results change when DNS changes. Source: https://www.rfc-editor.org/rfc/rfc7208.html and https://developers.google.com/speed/public-dns/docs/doh/json.
When to use this tool
SPF policies can become difficult to review when several sending services add include mechanisms. This inspector lists supported terms and estimates their contribution to the SPF DNS-causing term budget. Paste mode stays local and counts only the supplied policy. Live mode reads public TXT records and follows literal include and redirect domains within limits. It is a policy investigation aid, not an authorization result for a particular email or sender IP.
- Review a proposed SPF record before adding another sending provider.
- Inspect nested include chains in a published policy.
- Distinguish literal IP mechanisms from terms that consume the evaluation budget.
How to use spf lookup-budget checker
Choose paste or live analysis
Paste one unquoted SPF TXT value for a private local check, or choose live mode and enter its domain. Live mode sends the domain and nested lookup hostnames to Google Public DNS.
Inspect the term table
Review mechanisms, their displayed budget cost and treatment. Paste mode does not fetch nested policies, so includes leave the estimate incomplete. Live traversal can also become incomplete because of macros, cycles or limits.
Review the sending inventory
Compare includes with services you actually use. Investigate warning conditions and consult your providers before removing terms. Use a full SPF evaluator with sender context when you need an actual authentication decision.
Count local terms without inventing nested results
Inputs
Use paste mode with v=spf1 ip4:192.0.2.0/24 a mx include:_spf.example.com ~all.
Result
The result shows three local DNS-causing terms: a, mx and include. ip4 and ~all cost zero in this budget. No TXT requests are made, and the analysis is labeled Incomplete estimate against the ten-term budget.
What it means
Three is the local count, not a complete policy total. The nested include could contain more terms, so the result cannot establish that the entire policy stays within the budget.
Common mistakes to avoid
Counting only include keywords
Other mechanisms, including a, mx and ptr, also consume this term budget. Review the complete policy rather than counting service includes alone.
Calling an estimate an SPF pass
The inspector has no sender IP, MAIL FROM or HELO context. A count cannot determine whether a particular message is authorized or whether its domain aligns for DMARC.
Deleting a provider without checking usage
An include may support transactional, support or marketing traffic. Confirm the sending inventory before changing DNS so you do not break a legitimate service.
Frequently asked questions
Definitions, edge cases, and practical next steps for this tool. Search all tool FAQs ↗
What does the ten-term budget represent?
SPF limits DNS-causing mechanisms and modifiers during evaluation. This tool estimates the supported terms contributing to that budget. It is not a simple count of network requests: cached repeated includes still count on repeated visits, and literal IP mechanisms do not consume this term budget.
Why is paste mode an incomplete estimate?
The pasted policy can reference include or redirect domains whose contents are unknown locally. Paste mode deliberately makes no DNS requests. It shows the terms present in your text and explains the missing nested expansion rather than treating unseen policies as zero-cost.
What does live mode look up?
It reads public TXT values for the entered domain and literal include or redirect destinations, with caching. It does not query A, AAAA, MX or PTR address data. Therefore, address-expansion and void-lookup limits are outside this inspection even when traversal completes.
Does a total above ten prove all my email fails?
No. The static estimate sums branches that a particular sender might not traverse before a match. An excessive estimate is a risk signal to investigate, not proof every message follows that path. A real evaluation needs sender identity and mechanism execution.
What happens to mechanisms after all?
Terms after an all mechanism are ignored because evaluation reaches that unconditional match first. A redirect modifier in a policy containing all is also ignored by this inspector. The treatment column helps distinguish present text from terms that affect its estimate.
Are SPF macros and cycles expanded?
Macros are not expanded. A macro-containing destination or an include cycle makes the estimate incomplete. Live traversal also has caps for requests, elapsed time, depth and visits. The tool does not substitute guessed domains or silently treat unfinished branches as safe.
Can I combine multiple SPF TXT records?
The live inspector stops when it encounters multiple SPF records rather than merging them into an invented policy. Review the DNS configuration with your provider. One domain’s TXT set can contain unrelated records, but multiple SPF policies require correction rather than arithmetic combination.
Does this diagnose deliverability or DMARC alignment?
No. It inspects a policy and budget estimate without evaluating a message. SPF authorization, From-domain alignment, DKIM signatures and inbox placement are separate questions. Use email headers and aggregate reports alongside an appropriate message-authentication workflow when investigating actual mail.
Explore the topic in the blog
Sources and method
Use the references below to check definitions and platform guidance. The model’s scope and limits are explained above. Read our editorial standards.