New SPF resolution chain and DNS lookup count monitoring

We’re excited to introduce SPF resolution chain, a new feature of SPF monitoring that shows how an SPF record is expanded through DNS during verification.

The resolution chain expands records that reference other DNS records through directives and modifiers such as include, redirect, a, and mx, unveiling how an apparently simple record often hides a much larger dependency tree.

The new Resolution chain section shows:

• The expanded include and redirect tree.
• DNS lookup counts for the full chain and for individual subtrees.
• Void lookups.
• DNS errors, missing SPF records, invalid records, and loops.
• Resolution timing.
• IP address resolution outcomes for a and mx mechanisms.
• MX address lookup counts.

This is especially useful for investigating SPF records that are close to or above the 10 DNS lookup limit, or for understanding which third-party providers are responsible for most of the SPF complexity.

The resolution chain is a static analysis, not a live SPF pass/fail check for a specific message. DMARCwise refreshes it periodically and uses it to power the following new SPF checks:

• DNS lookup limit must not be exceeded.
• Void lookup limit must not be exceeded.
• MX address lookup limit must not be exceeded.
• Resolution chain must be resolvable.
• Resolution chain should resolve quickly.

Learn more about how this feature works in detail in SPF resolution chain, or head over to the dashboard to try it out. All domains have been already scanned.

This improvement to SPF monitoring also lays the groundwork for future features on our roadmap, such as activity correlation, which will show which parts of your SPF records are actually used by your email infrastructure.