Analysis · RFC 7208 §4.6.4
SPF tree
A server checking SPF may evaluate at most 10 DNS-querying terms, everything you include counted; past them the result is permerror and SPF no longer helps. The tree shows each record in the order it is evaluated and where the limit is crossed.
The limit of 10, in short
- What counts
The
include,a,mx,ptrandexiststerms and theredirectmodifier query DNS and count, together with everything in the records they include.ip4,ip6andallcost nothing. Past 10, the result is permerror (RFC 7208 §4.6.4). - In what order
Terms are evaluated left to right and the first match decides; an
includeis evaluated on the spot, aredirectonly at the end, if nothing matched (§4.6.2, §6.1). Nothing afterallis evaluated (§5.1). - Void lookups
A name that does not exist or lacks the record asked for is a void lookup; receivers should allow at most 2, and past them the result is permerror. An
mxmay name at most 10 hosts (§4.6.4). - How to cut down
Remove the includes of services you no longer use, and repeated ones. Where addresses are stable,
ip4/ip6instead ofaormxcost nothing. Copying a provider's addresses instead of its include saves lookups, but breaks when the provider changes its addresses.
Sources: RFC 7208 §4.6.4 · §5 · §6.1