SPF SPF Manager
Check your SPF

SPF report

ns.nl

Close to the limit — one more provider can break delivery 8 / 10 DNS lookups

Flatten ns.nl

Free for one domain. No credit card.

SPF Health

75 / 100
Risk Medium

Close to the limit — one more provider can break delivery 8 / 10 DNS lookups

  • 95–100 Healthy
  • 80–94 Good
  • 60–79 Needs attention
  • 40–59 High risk
  • 0–39 Critical

Include depth: 2

Estimated with SPF Manager

100 / 100 · 4 / 10 lookups

This record uses Close to the limit — one more provider can break delivery 8 of 10 DNS lookups

SPF Lookup Limit: The 10 DNS Lookup Rule

RFC 7208 limits SPF evaluation to ten DNS lookups, and exceeding that limit causes a PermError that breaks authentication.

Read article

SendGrid contributes 2 lookups. Microsoft 365 contributes 1 lookup. Mailchimp contributes 1 lookup. Salesforce contributes 1 lookup. _spf-a.ns.nl contributes 1 lookup. _spf-b.ns.nl contributes 1 lookup. _spf.mail.services.bastion365.net contributes 1 lookup. Total: 8 / 10 lookups.

Detected sources

SendGrid · 2 lookups Microsoft 365 · 1 lookup Mailchimp · 1 lookup Salesforce · 1 lookup _spf-a.ns.nl · 1 lookup _spf-b.ns.nl · 1 lookup _spf.mail.services.bastion365.net · 1 lookup

What we found

2 things worth knowing about this record, most serious first.

  • High

    Record too long for DNS

    A single DNS TXT string may not exceed 255 characters, and oversized responses can be truncated in transit. The TXT records on this domain total 3121 bytes, which risks truncation.

    Read more about this →
  • Note

    Macro in use

    The mechanism exists:%{i}._spf.mta.salesforce.com uses an SPF macro. Macros are evaluated per message and cannot be flattened, so this lookup stays even after flattening.

    Read more about this →

How the 8 lookups are counted

RFC 7208 counts one DNS lookup for each include, redirect, a, mx, ptr, and exists mechanism evaluated — including nested chains.

8 / 10 used

SendGrid · 2 Microsoft 365 · 1 Mailchimp · 1 Salesforce · 1 _spf-a.ns.nl · 1 _spf-b.ns.nl · 1 _spf.mail.services.bastion365.net · 1
  1. 1
    include _spf-a.ns.nl

    Counted toward _spf-a.ns.nl

  2. 2
    include _spf-b.ns.nl

    Counted toward _spf-b.ns.nl

  3. 3
    include spf.protection.outlook.com

    Counted toward Microsoft 365

  4. 4
    include sendgrid.net

    Counted toward SendGrid

  5. 5
    include ab.sendgrid.net Nested

    Counted toward SendGrid · depth 2

  6. 6
    include _spf.mail.services.bastion365.net

    Counted toward _spf.mail.services.bastion365.net

  7. 7
    include servers.mcsv.net

    Counted toward Mailchimp

  8. 8
    exists %{i}._spf.mta.salesforce.com

    Counted toward Salesforce

Each row is one DNS lookup consumed while evaluating your SPF record. The segments above sum to 8.

What if you changed something

Turn a sender off to see what removing it would free up, or add one to see how close it takes you to the limit. Nothing here changes your DNS — it is arithmetic on the numbers above.

Add more sender(s), each costing

Lookups in that scenario

/

Starting point: 8 of 10 lookups as published today.

How your SPF chain becomes one include

See what changes when ns.nl moves to one managed include.

Current situation

Health score
75 / 100
Lookup count
Close to the limit — one more provider can break delivery 8 / 10
Detected providers
SendGrid Microsoft 365 Mailchimp Salesforce
Risk
MEDIUM

After SPF Manager

Health score
100 / 100
Lookup count
4 / 10
Room to grow
6 lookups spare
Providers
Automatically managed
Risk
NONE
Score potential 75 → 100

Watch the chain collapse

Watch nested provider includes collapse into a single managed include.

Before → After

Your DNS today

TXT @ ns.nl

v=spf1 include:… +8 includes

Close to the limit — one more provider can break delivery 8 / 10 lookups

SendGrid

include:sendgrid.net

1 lookup

SendGrid

Nested

include:ab.sendgrid.net

1 lookup

Microsoft 365

include:spf.protection.outlook.com

1 lookup

Mailchimp

include:servers.mcsv.net

1 lookup

Salesforce

include:%{i}._spf.mta.salesforce.com

1 lookup

_spf-a.ns.nl

Unidentified

include:_spf-a.ns.nl

1 lookup

_spf-b.ns.nl

Unidentified

include:_spf-b.ns.nl

1 lookup

_spf.mail.services.bastion365.net

Unidentified

include:_spf.mail.services.bastion365.net

1 lookup

With SPF Manager

TXT @ ns.nl

v=spf1 include:ns.nl.flat-spf.com -all

4 / 10 lookups

SPF

Managed include

ns.nl.flat-spf.com

Resolves 8 providers automatically

Validated · 4 / 10 lookups
Paused — compare your current SPF chain with one managed include side by side. Each provider include consumes DNS lookups toward the 10-lookup limit. Flattening provider includes into one managed record… Your public SPF stays simple — SPF Manager maintains the rest.

What changes if you let us manage it

One include, whatever you add

Your record becomes a single include that we host. Adding another provider later changes what resolves behind it, not what you publish, so your own record stops growing toward the 10-lookup limit.

Provider changes are our problem

When a provider quietly starts sending from new addresses — or starts costing more lookups than it used to — we see it and republish. You never find out from a bounce.

Always current, never touched

You publish one TXT record once. From then on the addresses behind it stay correct without you editing DNS again.

Flatten ns.nl

Free for one domain. No credit card.

Specific actions for this domain

  • Reduce lookup headroom risk

    You are at 8 of 10 lookups. One additional provider update could push the record over the RFC limit.

  • Switch to a managed include

    Publish one managed include in DNS and let SPF Manager resolve provider includes behind it.

All SPF includes

Expand each source to see include records, lookup contribution, nesting depth, and guidance.

  • include:sendgrid.net
    depth 1 1 lookup
  • include:ab.sendgrid.net
    Nested depth 2 1 lookup

Recommendation: keep authorized, but monitor for nested include changes.

Managed automatically with SPF Manager

  • include:spf.protection.outlook.com
    depth 1 1 lookup

Recommendation: keep authorized, but monitor for nested include changes.

Managed automatically with SPF Manager

  • include:servers.mcsv.net
    depth 1 1 lookup

Recommendation: keep authorized, but monitor for nested include changes.

Managed automatically with SPF Manager

  • exists:%{i}._spf.mta.salesforce.com
    depth 1 1 lookup

Recommendation: keep authorized, but monitor for nested include changes.

Managed automatically with SPF Manager

  • include:_spf-a.ns.nl
    depth 1 1 lookup

Recommendation: keep authorized, but monitor for nested include changes.

Managed automatically with SPF Manager

  • include:_spf-b.ns.nl
    depth 1 1 lookup

Recommendation: keep authorized, but monitor for nested include changes.

Managed automatically with SPF Manager

  • include:_spf.mail.services.bastion365.net
    depth 1 1 lookup

Recommendation: keep authorized, but monitor for nested include changes.

Managed automatically with SPF Manager

Share this report

Send it to whoever manages your DNS before anything changes.

Analyzed 0 seconds ago.