SPF report
geenstijl.nl
Close to the limit — one more provider can break delivery 9 / 10 DNS lookups
Free for one domain. No credit card.
SPF Health
Close to the limit — one more provider can break delivery 9 / 10 DNS lookups
- 95–100 Healthy
- 80–94 Good
- 60–79 Needs attention
- 40–59 High risk
- 0–39 Critical
Include depth: 3
Estimated with SPF Manager
100 / 100 · 3 / 10 lookups
This record uses
Close to the limit — one more provider can break delivery
9
of 10
DNS lookups
SPF Lookup Limit: The 10 DNS Lookup Rule
RFC 7208 limits SPF evaluation to ten DNS lookups, and exceeding that limit causes a PermError that breaks authentication.
Read article
SPF Lookup Limit: The 10 DNS Lookup Rule
RFC 7208 limits SPF evaluation to ten DNS lookups, and exceeding that limit causes a PermError that breaks authentication.
Read articleMailgun contributes 7 lookups. Google Workspace contributes 1 lookup. spf.revue.co contributes 1 lookup. Total: 9 / 10 lookups.
Detected sources
What we found
2 things worth knowing about this record, most serious first.
-
High
Record too long for DNS
A single DNS TXT string may not exceed 255 characters, and oversized responses can be truncated in transit. The TXT records on this domain total 523 bytes, which risks truncation.
Read more about this → -
Medium
Close to the DNS lookup limit
This record uses 9 of 10 DNS lookups. Adding one more provider, or a provider adding one more include of their own, pushes it over.
Read more about this →
How the 9 lookups are counted
RFC 7208 counts one DNS lookup for each include, redirect, a, mx, ptr, and exists mechanism evaluated — including nested chains.
9 / 10 used
-
1
include
mailgun.orgCounted toward Mailgun
-
2
include
_spf.mailgun.orgNestedCounted toward Mailgun · depth 2
-
3
include
_spf1.mailgun.orgNestedCounted toward Mailgun · depth 3
-
4
include
_spf2.mailgun.orgNestedCounted toward Mailgun · depth 3
-
5
include
_spf.eu.mailgun.orgNestedCounted toward Mailgun · depth 2
-
6
include
eu.mailgun.orgCounted toward Mailgun
-
7
include
_spf.eu.mailgun.orgNestedCounted toward Mailgun · depth 2
-
8
include
_spf.google.comCounted toward Google Workspace
-
9
include
spf.revue.coCounted toward spf.revue.co
Each row is one DNS lookup consumed while evaluating your SPF record. The segments above sum to 9.
What if you changed something
Turn a sender off to see what removing it would free up, or add one to see how close it takes you to the limit. Nothing here changes your DNS — it is arithmetic on the numbers above.
Lookups in that scenario
/
With SPF Manager
/
Unchanged, whatever you add.
Starting point: 9 of 10 lookups as published today.
How your SPF chain becomes one include
See what changes when geenstijl.nl moves to one managed include.
Current situation
- Health score
- 60 / 100
- Lookup count
- Close to the limit — one more provider can break delivery 9 / 10
- Detected providers
- Mailgun Google Workspace spf.revue.co
- Risk
- MEDIUM
After SPF Manager
- Health score
- 100 / 100
- Lookup count
- 3 / 10
- Room to grow
- 7 lookups spare
- Providers
- Automatically managed
- Risk
- NONE
Watch the chain collapse
Watch nested provider includes collapse into a single managed include.
Your DNS today
TXT @ geenstijl.nl
v=spf1 include:… +8 includes
Close to the limit — one more provider can break delivery 9 / 10 lookups
Mailgun
include:eu.mailgun.org
Mailgun
include:mailgun.org
Mailgun
Nestedinclude:_spf.eu.mailgun.org
Mailgun
Nestedinclude:_spf.mailgun.org
Mailgun
Nestedinclude:_spf1.mailgun.org
Mailgun
Nestedinclude:_spf2.mailgun.org
Google Workspace
include:_spf.google.com
spf.revue.co
Unidentifiedinclude:spf.revue.co
With SPF Manager
TXT @ geenstijl.nl
v=spf1 include:geenstijl.nl.flat-spf.com -all
3 / 10 lookups
Managed include
geenstijl.nl.flat-spf.com
Resolves 8 providers automatically
What changes if you let us manage it
One include, whatever you add
Your record becomes a single include that we host. Adding another provider later changes what resolves behind it, not what you publish, so your own record stops growing toward the 10-lookup limit.
Provider changes are our problem
When a provider quietly starts sending from new addresses — or starts costing more lookups than it used to — we see it and republish. You never find out from a bounce.
Always current, never touched
You publish one TXT record once. From then on the addresses behind it stay correct without you editing DNS again.
Free for one domain. No credit card.
Specific actions for this domain
-
Reduce lookup headroom risk
You are at 9 of 10 lookups. One additional provider update could push the record over the RFC limit.
-
Replace nested includes
Include depth is 3. Nested provider chains increase permerror risk and make troubleshooting harder.
-
Switch to a managed include
Publish one managed include in DNS and let SPF Manager resolve provider includes behind it.
All SPF includes
Expand each source to see include records, lookup contribution, nesting depth, and guidance.
-
include:eu.mailgun.orgdepth 1 1 lookup -
include:mailgun.orgdepth 1 1 lookup -
include:_spf.eu.mailgun.orgNested depth 2 2 lookups -
include:_spf.mailgun.orgNested depth 2 1 lookup -
include:_spf1.mailgun.orgNested depth 3 1 lookup -
include:_spf2.mailgun.orgNested depth 3 1 lookup
Recommendation: fold this provider behind one managed include to reduce lookup sprawl.
Managed automatically with SPF Manager
-
include:_spf.google.comdepth 1 1 lookup
Recommendation: keep authorized, but monitor for nested include changes.
Managed automatically with SPF Manager
-
include:spf.revue.codepth 1 1 lookup
Recommendation: keep authorized, but monitor for nested include changes.
Managed automatically with SPF Manager
Share this report
Send it to whoever manages your DNS before anything changes.
Analyzed 0 seconds ago.