SPF DNS lookup checker
Two numbers. The DNS lookup count against the RFC 7208 limit of 10 — the one that produces too many DNS lookups and PermError. And the number of IPv4 addresses your chain authorizes to send mail as your domain, which is the number the error is hiding and almost nobody runs.
Count your own record
Enter a domain. Warden walks its SPF chain through public DNS, counts the lookups against the limit of 10, and totals the IPv4 space the chain authorizes to send as you. Every record it read is shown underneath, so you can check the arithmetic.
What it counts, and how
The chain is walked the way a receiving mail server walks it: read the v=spf1 TXT record, resolve every include: it points at, and keep going until nothing new appears.
- Lookup cost: include, a, mx, exists, ptr and redirect each cost one against the limit of 10. The MX names an mx mechanism returns count against the same limit, so a domain with five MX records spends six lookups there, not one.
- Free of charge against the limit: ip4, ip6 and all. This is why flattening a record clears the error without reducing what the record trusts.
- Authorized space: every unique ip4 block in the whole chain, converted to its address count and summed with overlapping blocks merged once. IPv6 blocks are listed rather than totalled, because they are not usefully countable.
- Policy: the final qualifier on all — ~all softfails, -all fails — read together with the DMARC record at _dmarc.yourdomain, because SPF alone says nothing about what a receiver should do when the check fails.
Limits stated plainly: the walk stops after 60 DNS queries and eight levels of nesting, and a chain deeper than that returns a floor rather than a total. Macros are not expanded. Results reflect DNS as it answered at the moment you pressed the button.
Questions this raises
Why does SPF fail with too many DNS lookups?
RFC 7208 caps SPF evaluation at 10 DNS-querying mechanisms. include, a, mx, exists, ptr and redirect each cost one, and the MX names an mx mechanism returns count against the same limit. Past 10, a receiver may return PermError and stop checking, so your SPF result becomes unusable regardless of how the record was written.
Which SPF mechanisms count against the limit of 10?
include, a, mx, exists, ptr and redirect all count. ip4, ip6 and all do not. That is why flattening a record into ip4 blocks fixes the error — and why the lookup count is a poor proxy for how much your domain actually trusts.
How many IP addresses does my SPF record authorize?
Sum every unique ip4 block in the whole chain: an IPv4 prefix of length n covers 2 to the power of (32 minus n) addresses. A /16 is 65,536. Chains that inherit several shared provider ranges routinely authorize hundreds of thousands of addresses, and the total is rarely known by the domain owner.
Is a large authorized address count a security incident?
No. It measures what is permitted, not what has happened, and a domain authorizing one well-run provider's range can have a large, defensible number. The finding is about ranges you do not control and senders nobody can name. Only DMARC aggregate reports show what is actually being sent in your name.
Does this tool scan my systems?
No. It reads public TXT and MX records — the same DNS any receiving mail server reads at delivery time. No mail is sent, no host is connected to, and nothing inside your systems is accessed. Warden does not access, scan or investigate anything without agreed scope and explicit written authorization.
Where this sits against your other findings
There is no CVE and no CVSS score for a record that trusts too much, so an over-broad SPF chain does not appear on the report that drives most remediation queues — while frequently outranking findings scored 9.8 on reachability, exploitability, business relevance and cost to fix. The worked version of that argument, including a real chain that authorized 1,086,996 addresses and the order of operations for reducing it without breaking your own mail, is in the teardown: SPF: too many DNS lookups — and the bigger number underneath it.
SPF is also one signal among several that are readable from outside. The exposure check reads this record alongside DMARC and the headers your homepage returns, and puts the result in priority order with the evidence for each.