SPF checker report

SPF report for cda.nl

We explain exactly why your SPF uses 9 of 10 DNS lookups

SPF Lookup Limit: The 10 DNS Lookup Rule

RFC 7208 limits SPF evaluation to ten DNS lookups, and exceeding that limit causes a PermError that breaks authentication.

Read article

— and how to fix it in minutes.

One additional provider update could push your SPF over the RFC lookup limit. Email delivery may fail without warning.

Why this matters ↓

Executive summary

The full story for cda.nl in one glance.

Current situation

Risk Medium
Lookup count 9 / 10
Providers detected Microsoft 365, Salesforce
Maintenance Manual updates expected

After SPF Manager

Risk None
Lookup count 1 / 10
Providers Synchronized automatically
DNS change One TXT record to publish

SPF Health 59 → 100 · Lookups 9 → 1

Protect cda.nl

Current vs future

See what changes when cda.nl moves to one managed include.

Current situation

Health score: 59 / 100
Lookup count: 9 / 10
Detected providers: Other Microsoft 365 Salesforce
Risk: MEDIUM

After SPF Manager

Health score: 100 / 100
Lookup count: 1 / 10
Providers: Automatically managed
Risk: NONE

Score potential 59 → 100

Estimated operational impact

Indicative savings based on provider complexity and your current SPF structure.

Estimated

These estimates are based on provider complexity and detected SPF structure. They are indicative, not guaranteed.

Estimated provider changes

~8 / year

Estimated manual DNS edits

~12 / year

Estimated time saved

~16h / year

Estimated risk reduction

~41%

SPF Health

59 / 100

Risk Medium

9 / 10 DNS lookups

Estimated with SPF Manager

100 / 100

95–100 Healthy
80–94 Good
60–79 Needs attention
40–59 High risk
0–39 Critical

Include depth: 6

Why this matters

Other contributes 6 lookups. Direct mechanisms contributes 1 lookup. Microsoft 365 contributes 1 lookup. Salesforce contributes 1 lookup. Total: 9 / 10 lookups.

Detected sources

Other · 6 lookups Direct mechanisms · 1 lookups Microsoft 365 · 1 lookups Salesforce · 1 lookups

Why fix this today

Your SPF record already uses 9 of 10 allowed DNS lookups.
One additional provider update could push this domain over the limit.
Some receivers may ignore SPF when the limit is exceeded.
Manual changes become risky when several providers depend on the same record.
exists is not flattenable.

Simulate next provider change

SPF risk is not static. The next provider update can push you over the limit — unless changes are synchronized automatically.

Current chain

9 / 10

Microsoft 365 adds another nested include

After simulated change

10 / 10 lookups

One step closer to the lookup limit.

With SPF Manager

1 / 10

Automatically synchronized

Provider changes are detected, validated, and folded into your managed include — your public DNS stays one record.

Specific actions for this domain

Reduce lookup headroom risk

You are at 9 of 10 lookups. One additional provider update could push the record over the RFC limit.
Replace nested includes

Include depth is 6. Nested provider chains increase permerror risk and make troubleshooting harder.
Switch to a managed include

Publish one managed include in DNS and let SPF Manager resolve provider includes behind it.

Reduce lookup sprawl for cda.nl with a managed SPF include that resolves provider includes automatically and keeps your published record predictable.

Protect cda.nl

Safe, validated SPF changes

Replacing a DNS record feels risky. SPF Manager is designed to keep you in control.

RFC-aware validation
One DNS record under your control
No direct DNS write access required
Original SPF remains visible in history
Reversible migration path
Provider changes synchronized automatically

How the 9 lookups are counted

RFC 7208 counts one DNS lookup for each include, redirect, a, mx, ptr, and exists mechanism evaluated — including nested chains.

9 / 10 used

Other · 6 Direct mechanisms · 1 Microsoft 365 · 1 Salesforce · 1

1

a cda.nl

Counted toward Direct mechanisms
2

include spf.protection.outlook.com

Counted toward Microsoft 365
3

include _spf.mailer.twinfield.com

Counted toward Other
4

include _spf.salesforce.com

Counted toward Salesforce
5

include spf.mandrillapp.com

Counted toward Other
6

include spf.afas.online

Counted toward Other
7

include _spf.mailgun.org

Counted toward Other
8

include _spf1.mailgun.org Nested

Counted toward Other · depth 2
9

include _spf2.mailgun.org Nested

Counted toward Other · depth 2

Each row is one DNS lookup consumed while evaluating your SPF record. The segments above sum to 9.

All SPF includes

Expand each source to see include records, lookup contribution, nesting depth, and guidance.

include:_spf.mailer.twinfield.com
depth 1 1 lookup
include:_spf.mailgun.org
depth 1 1 lookup
include:spf.afas.online
depth 1 1 lookup
include:spf.mandrillapp.com
depth 1 1 lookup
include:_spf1.mailgun.org
Nested depth 2 1 lookup
include:_spf2.mailgun.org
Nested depth 2 1 lookup

Recommendation: fold this provider behind one managed include to reduce lookup sprawl.

Managed automatically with SPF Manager

a:cda.nl
depth 1 1 lookup

Recommendation: keep authorized, but monitor for nested include changes.

Managed automatically with SPF Manager

include:spf.protection.outlook.com
depth 1 1 lookup

Recommendation: keep authorized, but monitor for nested include changes.

Managed automatically with SPF Manager

include:_spf.salesforce.com
depth 1 1 lookup

Recommendation: keep authorized, but monitor for nested include changes.

Managed automatically with SPF Manager

Could this have been prevented?

Manual SPF maintenance repeats the same risky work. SPF Manager synchronizes provider changes automatically.

Manual SPF today

Microsoft changes SPF → manual DNS update !
Google changes SPF → manual DNS update !
Mailchimp changes SPF → manual DNS update !
Salesforce changes SPF → manual DNS update !

With SPF Manager

Provider change detected
SPF output validated
Managed include synchronized
Your DNS stays unchanged

How your SPF chain becomes one include

Watch nested provider includes collapse into a single managed include.

Before → After

Your DNS today

TXT @ cda.nl

v=spf1 include:… +9 includes

9 / 10 lookups

Other

include:_spf.mailer.twinfield.com

1 lookup

Other

include:_spf.mailgun.org

1 lookup

Other

include:spf.afas.online

1 lookup

Other

include:spf.mandrillapp.com

1 lookup

Other

Nested Other

include:_spf1.mailgun.org

1 lookup

Other

Nested Other

include:_spf2.mailgun.org

1 lookup

Direct mechanisms

include:cda.nl

1 lookup

Microsoft 365

include:spf.protection.outlook.com

1 lookup

Salesforce

include:_spf.salesforce.com

1 lookup

With SPF Manager

TXT @ cda.nl

v=spf1 include:cda.nl.flat-spf.com -all

1 / 10 lookups

SPF

Managed include

cda.nl.flat-spf.com

Resolves 9 providers automatically

Validated · 1 / 10 lookups

Paused — compare your current SPF chain with one managed include side by side. Each provider include consumes DNS lookups toward the 10-lookup limit. Flattening provider includes into one managed record… Your public SPF stays simple — SPF Manager maintains the rest.

Generate managed SPF for cda.nl

One managed include resolves your provider chain and keeps changes synchronized automatically.

Generate managed SPF for cda.nl

Fix cda.nl in minutes

Generate a managed SPF include for cda.nl and keep provider changes synchronized automatically — setup takes just a few minutes.

SPF Health 59 → 100 · Lookups 9 → 1

Fix cda.nl in minutes

No credit card required. You stay in control of your DNS records.

Share this report

Share this report with a client, colleague, or DNS administrator before making changes.

Email authentication platform

SPF is live today. Additional modules will plug into the same report experience.

SPF

Included in this report

Analyzed

DKIM

Expands your deliverability coverage

Coming soon

DMARC

Expands your deliverability coverage

Coming soon

Expands your deliverability coverage

Coming soon

DNSSEC

Expands your deliverability coverage

Coming soon

Analyzed 5 hours ago.