mailpassed research · 2026-10-25 · first published here

7.4% of top domains are one include away from breaking SPF

Short answer: 7.4% of the top domains that publish SPF already use 9–10 of the 10 DNS lookups SPF allows, and 2.9% are over the limit, so receivers treat their SPF as broken for every message. Another 1.3% include a name that no longer exists.

71,313

domains with SPF

5,296 (7.4%)

at 9–10 lookups (one change from failing)

2,087 (2.9%)

over 10 lookups (already failing)

909 (1.3%)

with an include that doesn't resolve

Why it matters

RFC 7208 caps an SPF check at 10 DNS lookups; the 11th makes the result permerror, which Gmail and Microsoft count as an SPF failure. Every include: costs at least one lookup, and big providers' includes cost more: Red Sift OnDMARC (~5.0 lookups), Atlassian (~2.0 lookups), Elastic Email (~2.0 lookups), Salesforce Pardot (~1.8 lookups), Mimecast (~1.7 lookups). Adding one more tool – a CRM, a help desk, a newsletter service – silently tips a near-limit record over.

An include whose target has no SPF record (or no longer exists) also ends the check in permerror. 881 domains have such an include in their own record and 28 inherit one from a provider's record.

Check your domain

  1. Run our checker: it counts lookups the way receivers do (nested includes too) and flags includes that don't resolve or point to unregistered domains.
  2. See what each include costs in the SPF include directory and on the provider status page.

How to fix it

  1. Remove includes for services you no longer use, and ones that aren't needed on your root domain (many newsletter and transactional services use their own bounce domain – check the service's guide).
  2. Send bulk mail from a subdomain with its own SPF record.
  3. Rebuild one record with the SPF generator; it shows the lookup count.

How we measured

We resolved the public DNS of the 99,704 live registrable domains in the Tranco top-100,000 list (scan of 2026-10-25): MX, SPF (with every include followed and counted the way receivers do), DMARC, MTA-STS and TLS-RPT, and fetched each MTA-STS policy over HTTPS with certificate checks. Unknown answers (DNS timeouts) are kept apart from missing records. We publish totals only and never name affected domains.

Related

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.