Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →An SPF lookup count is not the number of include: strings visible in a domain’s top-level record. Under RFC 7208, the evaluator counts specified DNS-triggering terms across the full evaluation, including referenced policies. The author of the GitHub checker example reports that an initial version showed 8 of 10 and a corrected version counted 10. That is an account of the checker’s implementation; GitHub’s live SPF evaluation was not independently reproduced here, and its policy can change.
Why a top-level SPF record can undercount
SPF evaluation can follow an include into another domain’s SPF policy, and a policy can also send evaluation onward with redirect. The ten-term limit applies across this full evaluation, not just to terms printed in the original domain’s record. A checker that counts only top-level references can therefore report too small a number.
As an Amazon Associate I earn from qualifying purchases.
The standard measures lookup-causing SPF terms during evaluation—not every DNS packet or network request made while resolving them. A tool’s count is useful only if its method follows the applicable evaluation paths and applies the RFC’s term rules.
Recommended Free Tools
Which SPF terms count toward the limit?
RFC 7208 §4.6.4 counts these mechanisms and modifier when they are reached during evaluation:
#1 Best Overall
includeamxptrexistsredirect
By contrast, all, ip4, and ip6 do not cause DNS queries during SPF evaluation and do not consume this ten-term budget. The exp modifier is also excluded from the evaluation-time limit: its explanation lookup occurs after evaluation.
So neither counting every SPF token nor counting only visible include: entries gives the RFC-defined total. The relevant question is how many counted terms the evaluator reaches across the policy chain.
What the reported GitHub count means
In the GitHub example, the author reports that the first version of their checker displayed 8 of 10, while a corrected implementation counted 10. The discrepancy is consistent with the difference between a shallow count and one that accounts for lookup-causing terms reached through referenced policies. The reported figure describes the checker’s analysis; it should not be treated as a permanent or independently verified property of GitHub’s current SPF record.
SPF policies and their dependencies can change. For a current diagnosis, inspect the record and the full evaluation at the time of the check, and confirm that the checker explains how it accounts for nested policies and redirects.
What happens when an evaluation exceeds ten?
RFC 7208 requires an SPF implementation to return permerror when evaluation exceeds the ten-term limit. The RFC defines permerror as meaning that the domain’s published records could not be correctly interpreted, and says the condition requires DNS operator intervention. It is not the same as a temporary DNS error: it signals a problem with the policy or its evaluation that needs correction.
The cap is a limit, not a target. A result of exactly ten is within the stated maximum; an evaluation that requires an eleventh counted term exceeds it.
Rank #4
Other SPF lookup limits are separate
The ten-term budget is not the only constraint in RFC 7208, but the additional rules do not grant extra room in that budget:
- For each
mxmechanism, the RFC separately limits the address records queried for each MX record. - The RFC recommends limiting “void lookups” to two.
These rules address different aspects of evaluation. They should not be added to, or mistaken for exceptions to, the ten lookup-causing-term limit.
Why the limit matters beyond one checker
A USENIX Security 2024 study reported that 3,584,014 domains—6.5% of its measured set—required more than ten DNS lookups. The paper’s dataset snapshot was dated March 27, 2023, so this is a historical study result, not an estimate of prevalence in 2026. It illustrates that over-limit SPF configurations are not merely a checker-display issue: under RFC 7208, exceeding the cap produces permerror.
Quick Recap
How to assess an SPF checker’s count
- Check whether it follows nested
includeandredirectevaluation rather than stopping at the top-level record. - Confirm it counts all reached lookup-causing terms:
include,a,mx,ptr,exists, andredirect. - Make sure it does not treat excluded terms such as
ip4,ip6,all, or evaluation-timeexpas additions to the ten-term budget. - Look for separate reporting of the MX address-record and void-lookup rules; those are not extra slots in the ten-term allowance.
Sources
- RFC 7208, §4.6.4 and §2.6.7, IETF Standards Track RFC, April 2014.
- Cloudflare: DNS lookup limit, updated May 5, 2026.
- USENIX Security 2024: “SPF Beyond the Standard: Assessing the Effectiveness of SPF Policies”.
- Adil Sadqi’s GitHub checker article, the source of the author-reported 8-to-10 correction.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
