Zendesk's SPF record has one entry. A receiver counts six.

Canva is at nine.

Nine of a possible ten, and I only know that because I spent an evening writing a counter that follows SPF records the way a receiving mail server follows them, rather than the way a person reads them.

The distinction matters more than it sounds. A receiver gets ten DNS lookups to evaluate your SPF. Ask for an eleventh and it stops, returns permerror, and permerror is a failure. Your mail is unauthenticated from that moment, and since February 2024 unauthenticated bulk mail to Gmail goes somewhere predictable, with no bounce to warn you.

The counting is where people get caught. Ten lookups, not ten entries. Your include pointing at a CRM costs one, then everything inside the CRM’s own record costs more on top of it. Their architecture becomes your budget. Nobody consulted you about it.

Fifteen domains went through the counter. Nobody was broken, which I want to state plainly instead of manufacturing alarm: not one exceeded the limit.

The averages are where it gets interesting. Read those records at face value and you get 4.1 lookups. Count the way a receiver counts and you get 5.3. A third more than the number anyone would read off their own DNS, hiding inside records that look short.

Zendesk publishes one include.

Following it costs six lookups. Six times what the record appears to say, and there is no way to know that from looking. HubSpot’s record contains a single redirect, which costs four. Both are perfectly fine today. Both are also completely opaque to the person who owns them.

Which brings me back to Canva, sitting at nine with eight includes in the line, each pointing at their own numbered subdomains. Tidy. Deliberate. Somebody clearly thought about it. And exactly one new vendor away from permerror, because the next tool the company buys arrives with its own include and its own nested chain, and nothing in that purchase decision will mention DNS.

That is the thing I find hard to live with about SPF. Your record can be correct on Monday and broken in November without anybody touching it, because a vendor you already trusted expanded theirs. Nothing errors. Nothing notifies you. The first symptom is open rate, and open rate has fifty explanations, so somebody spends a quarter rewriting subject lines.

So: count recursively, not by eye. Above eight and you are close enough that ordinary procurement can break your authentication. Strip out services you stopped using, because old includes survive in DNS for years after the contract ends. And when a vendor offers a fixed IP range instead of an include, take it.

Dropbox is the illustration for that last one. Their record is enormous, page after page of ip4 blocks written longhand, and the entire thing costs seven lookups, because IP ranges are free. Ugly. Deliberate. Cheap where it counts.

I have not worked out whether nine deserves action. Canva is inside the limit and has presumably been fine for years, and telling a company to restructure DNS on the strength of one lookup of headroom is the kind of advice that wastes an engineering week. But the failure is silent and it is delayed, and I would rather not find out about it from a traffic chart six weeks after somebody in procurement signed something.

Questions people ask about this