Free tools · Email domain setup
SPF Too Many DNS Lookups: Find the Cause
An SPF policy can look short while its nested includes cause many DNS lookups. Check the published policy, identify the services you still use and review the references before removing anything.
Real public DNS lookup. No signup, mailbox connection or API key needed.
Check your published SPF record
Enter your own public domain. The illustrated examples below are not preloaded and no lookup runs until you submit.
Look up your public SPF record.
Enter your domain to see the published record and any issues found. Results appear here after a real DNS lookup.
SPF record generator
Create a TXT record from the settings you choose. This builder runs in your browser and produces text for you to review. It does not update DNS.
Your TXT record
Add the settings you intend to publish, then generate the text. Compare it with your existing record before making changes with your DNS provider.
What to do next
1. Check the envelope-sender domain
Enter the domain used for the message's Return-Path, or ask your sending provider which domain to inspect. It can differ from the visible From address.
2. Review nested references
SPF limits DNS-causing terms to ten during evaluation, including nested references that are reached. An include can lead to more includes. The lookup count is not simply the number of TXT records shown.
3. Match each service to a real sender
List your mailbox provider, support system, newsletter service and any other authorised sender. Confirm unused services with their owners before removing their entries.
4. Change and retest deliberately
Use current provider instructions to prepare one policy, publish it through your DNS host and inspect the result after caches update. Test representative messages from every service.
An illustrated include chain
example.com → include:mail-a.example.com mail-a.example.com → include:relay-a.example.com relay-a.example.com → more DNS-dependent terms
These domains are fictional. An included policy can add work beyond the entry visible in the first record. This diagram is not a measured count or a record to publish.
A bounded review can be incomplete
The checker follows supported include and redirect references within its own limits. Unsupported mechanisms, lookup failures and a partial review are shown explicitly. It does not evaluate a particular sending IP.
Avoid a static copy of a provider's IP list
Providers can change their sending ranges. Replacing their maintained include with a copied list creates an ongoing maintenance task and can break legitimate mail later.
Questions
Does every SPF term consume this limit?
No. DNS-dependent mechanisms such as include, a and mx contribute when evaluated. An ip4 or ip6 literal and all do not require these DNS lookups. Nested policies and separate protocol limits also matter.
Does this tool repair the record automatically?
No. It reports published evidence and offers a builder using your explicit sending sources. It cannot decide which business services are still authorised.
Checking sends your public domain to AskQuokka. Record generation and copying run in this tab. No DNS settings are changed and no email is sent. Domain inputs and lookup results are not included in tool analytics.
Official references
References checked 23 October 2026. Use your provider's current domain-specific values.
More setup and troubleshooting guides
Multiple SPF Records: How to Review and Fix Them
Understand duplicate SPF policies, distinguish TXT chunks from separate records and prepare one policy from confirmed senders. Free checker included.
Google Workspace SPF Record: Setup and Check
Check Google Workspace SPF, review the Google-only policy and account for other sending services before changing DNS. Free checker and record builder.