SPF Lookup Tree
Visualize the full SPF include chain and DNS lookup depth for a domain. SPF has a 10-lookup limit — exceeding it causes authentication failures for every message, not just the overflow.
What the tree shows
SPF records commonly include other SPF records — your provider's include might itself include two or three more. Reading a flat SPF record doesn't tell you how deep that nesting goes or which branch is consuming your lookup budget. This tool expands every level of the include chain into a tree, so you can see the exact path from your root record down to the mechanism that's about to push you over 10 lookups.
How to use the result
Each node shows its own lookup count and the mechanism that pulled it in. Expand branches near the limit to identify which specific include is the biggest contributor — that's usually the first candidate to flatten or replace with a direct ip4: entry if the provider publishes static ranges.
Common mistakes
- Counting only your own top-level
include:entries and missing lookups incurred by nested includes several levels down. - Ignoring a record that's currently under 10 lookups but close — adding one more sending service later can tip it over without warning.
- Not re-checking after a provider changes their own SPF include structure, which can silently add lookups.
Keep an eye on this automatically
A one-off check tells you how things look right now. DMARC.WS collects your aggregate reports continuously, shows you which senders are failing authentication, and alerts you when something changes.
Free plan includes 5 domains. No card required.