An SPF record tells receivers which servers are allowed to send mail on behalf of a domain. Every WordPress site that sends email through more than one provider ends up combining include: mechanisms in the same TXT record. Add a mailer plugin here, a marketing service there, a form host on the side, and the record grows. Past a certain point it breaks in a way most site owners never see.
RFC 7208 caps a single SPF evaluation at ten DNS lookups. Each include:, a, mx, exists:, or redirect= counts. Cross that ceiling and receivers return PermError; most treat the message as if there were no SPF at all, and Gmail, Yahoo, and Microsoft 365’s bulk-sender scorecards mark the domain as failing. Paste the current record, pick the providers actually in use, and this tool returns a merged, deduplicated record with the running lookup count on the badge.
Lookups counted per RFC 7208 §4.6.4 (a, mx, include:, exists:, redirect=, ptr). ip4:, ip6:, and all don’t count. Receivers hitting the limit return PermError, and most treat the message as if there were no SPF at all — so staying under 10 matters.
How the merge works
- Existing record parsed first. Mechanisms come out in the order they appeared; the
allqualifier is preserved (-all,~all,?all). Paste rawdig +short TXToutput with the split quoted strings and it’s normalised the same way a resolver would assemble it. - Provider includes appended. Every provider carries a canonical
spf_includeslist in theproviders.jsondataset. SendGrid contributessendgrid.net, Mailgun contributesmailgun.org, Zoho Mail contributes bothzoho.comandzohomail.com, and so on. Pick a WP mailer plugin and the tool prefills the provider multiselect with the providers that plugin supports. - Duplicates dropped. If the existing record and a provider selection both point to the same
include:, only one copy survives. The dropped entries are listed under the merged record so nothing is silent. - Lookup count enforced. The badge counts the surviving mechanisms that trigger a DNS lookup (
include:,a,mx,exists:,redirect=,ptr). It turns amber at eight and red at eleven.ip4:,ip6:, andallnever count against the budget.
When a merge won’t save the record
Deduplication buys back one or two lookups, sometimes three. It cannot turn a fifteen-provider record into a compliant one. If the merged output shows twelve or thirteen lookups, the answer is not a cleverer SPF, it’s fewer senders on the same domain. Split marketing off to a subdomain (news.example.com) with its own SPF, keep transactional on the root, and each record stays under the ceiling on its own. That’s the same architectural move Microsoft 365, Google Workspace, and every large sender uses internally, and it’s the only durable answer once a domain is genuinely wired to more than eight or nine services.
Related tools
When you’re ready to check what a receiver actually sees for a domain, the DNS Auth Checker resolves SPF, DKIM, DMARC, and MX live and scores the domain against Gmail, Yahoo, and Microsoft 365’s bulk-sender requirements. If the merge here turned up a provider that no longer belongs, the free-tier comparator is the fast way to pick the one provider a small WordPress site actually needs, and the SMTP cost calculator is the next step above the free tiers.