Guides

How many includes one SPF record can hold

Last updated 2026-09-08

You've got Google Workspace for staff mail, a marketing platform, a helpdesk and an invoicing tool, and each one has handed you an include: to add. You can add as many as you like. What SPF limits is DNS lookups. The whole evaluation gets ten, and each include: spends at least one. How many more it spends is up to the provider that published it.

How many includes can one record have? As many as fit inside ten DNS lookups. Four is often fine and sometimes too many, because the cost of each is set by somebody else.

An include costs whatever its provider publishes

An include: spends one lookup to fetch the target's record, then pays for everything inside it. Providers nest their own includes in there, and they change them without telling you. Two records that look the same in your DNS panel can cost very different amounts:

That's how a record that passed on Monday returns permerror on Friday with nobody having touched it. A provider added an include to their own record, your total crossed ten, and every sender in your record lost its pass at once.

The SPF checker resolves the whole chain of a published record and gives you the real count. The pre-flight does the same for a record you haven't published yet, which is the one you want when you're about to add the fourth include.

Add the include to the record you have

The new term goes inside the existing record. A second v=spf1 record breaks both, and the multiple SPF records guide covers why.

Before:

After:

Keep all at the end. Receivers stop at the first match and all matches everything, so the receiver never reads an include placed after it. The record is still valid and every other sender still passes, so you'd only find out from that one sender's reports.

When the fourth include won't fit

Four ways to get back under ten, least upkeep first.

Remove what isn't sending. Records collect includes for platforms that were trialled once and cancelled, and each one still costs a lookup. Your DMARC aggregate reports show which includes authorised real mail last month and which authorised none.

Replace an include with the addresses behind it. A provider that sends from a small fixed range usually documents it, and ip4: terms cost nothing. The ranges are now yours to maintain, though. When the provider renumbers, your record is wrong and you'll find out from a bounce.

Move a bulk sender to its own subdomain. Send marketing from mail.example.com with its own SPF record and its own ten lookups. Your main domain keeps staff mail and gets its budget back. Mail from the subdomain aligns to the subdomain, which DMARC accepts under relaxed alignment.

Flatten the record. Resolve every include down to addresses and publish those. You'll be well under the limit, and every future change is now somebody's job, because a flattened record goes stale the day a provider renumbers. The 10-lookup limit guide compares these in more detail.

Check the count before it's live

Every option above changes the record, and a record over the limit fails every sender in it, the ones you didn't touch included. Paste the new record into the pre-flight. It resolves the whole chain against live DNS, gives you the lookup count, and names any sender that would stop passing.

The count is a snapshot either way. Your includes belong to other people, and they change them on their own schedule. Our weekly digest reads your DMARC reports and mails you when a source that used to pass stops, which is how you hear about somebody else's edit before your customers do.

DomainCanary is a DMARC monitoring service that turns your domain's aggregate reports into one weekly email.