SPF resolution chain

SPF evaluation rarely stops at the first DNS TXT record. Many real SPF records delegate part of the work to other SPF records through directives such as include and redirect, and can also trigger additional DNS lookups through mechanisms such as a and mx.

The SPF resolution chain shows how DMARCwise expands and evaluates that dependency tree.

It helps you understand which providers are included, where DNS lookups are spent, whether SPF limits are exceeded, and which records or mechanisms are responsible for loops, DNS errors, missing SPF records, dynamic macro-based terms, or slow resolution.

What the chain shows

The chain starts with your domain and then lists every SPF term in evaluation order:

• include and redirect entries are expandable when DMARCwise was able to resolve the target domain’s SPF record. Expanding them shows the mechanisms and nested includes inside that record.
• a, mx, exists, and ptr entries show DNS-dependent mechanisms. These can affect lookup limits even when they do not reference another SPF record.
• ip4, ip6, and all entries are shown in place so you can understand the full record, but they do not perform DNS lookups.
• Qualifiers such as +, ~, -, and ? are preserved so the record is shown accurately, but they do not affect this static chain evaluation. Producing an actual SPF pass, fail, softfail, or neutral result requires runtime data such as the sender IP address.
• Terms that could not be parsed are shown as invalid or unknown terms.

Lookup counts

The SPF specification defines a strict limit of 10 DNS lookups for directives and modifiers that perform DNS queries (RFC 7208 section 4.6.4).

DMARCwise displays the total lookup count for the whole chain at the top of the chain. It also shows the lookup count contributed by the individual subtrees, so you can easily see which include or redirect terms are responsible for the cost.

The initial TXT lookup for your own domain is not counted toward the SPF limit, following the SPF lookup limit rules.

The following terms can increase the SPF lookup count:

• include
• redirect
• a
• mx
• exists
• ptr

The following terms do not increase the DNS lookup count:

• ip4
• ip6
• all

If the total is above 10, DMARCwise shows a DNS lookup limit exceeded alert. Mail servers adhering to the SPF specification will treat this as a permanent SPF error, which can affect deliverability.

Void lookups

A void lookup is a DNS query that returns no answers, either because the name does not exist or because the DNS response is empty. RFC 7208 section 4.6.4 recommends limiting void lookups to 2 and treating records that exceed the limit as a permanent SPF error.

DMARCwise shows void lookups next to the term that caused them and shows a global Void lookup limit exceeded alert if the chain produces too many.

Resolution timing

The root row shows the total time DMARCwise needed to resolve the chain.

Rows with DNS lookups also expose their lookup duration when you hover over them, and expandable rows show how long their subtree took in total.

Slow SPF resolution does not always mean the record is invalid, but it increases the chance that receivers encounter temporary errors. DMARCwise therefore checks whether the chain resolves within 20 seconds, based on RFC 7208 section 4.6.4.

Resolved IPs and MX address lookups

For a and mx mechanisms, DMARCwise resolves the addresses and records the resolved IP count. For mx, the chain also tracks how many MX hosts required A/AAAA address resolution.

Each mx mechanism has a separate limit of 10 address lookups (RFC 7208 section 4.6.4). If an mx mechanism needs more than that, DMARCwise marks the node and shows an MX address lookup limit exceeded alert. This limit is separate from the overall 10 DNS lookup limit for SPF mechanisms and modifiers.

Dynamic and incomplete chains

Some SPF terms cannot be fully resolved from a static scan alone. Real SPF evaluation happens while a receiver is processing a message, and some mechanisms depend on runtime context such as the sender IP address or SPF macro expansion.

DMARCwise marks these terms as dynamic. The most common dynamic cases are:

• An include or redirect target contains SPF macros. The target domain is only known during real message evaluation, so its subtree cannot be expanded.
• An a, mx, exists, or ptr mechanism contains macros.
• A ptr mechanism requires the sender IP address to evaluate.

When dynamic terms, DNS errors, invalid records, loops, or missing include and redirect targets prevent full resolution, DMARCwise shows a Resolution chain is incomplete alert with the reason.

When those same conditions mean the lookup total may be a lower bound instead of the complete count, DMARCwise also shows Lookup counts may be underestimated.

Errors and warnings

Each row can show its own status message:

• Loop detected: an include or redirect points back to a domain already in the current path.
• No SPF record found: an include or redirect target resolved successfully, but no SPF record was found there.
• Invalid SPF syntax or Unknown or invalid term: the record or term could not be parsed correctly.
• DNS error or DNS timeout: DNS resolution failed while walking the chain.
• Dynamic: macro expansion required: the term contains SPF macros that need runtime message context.
• Dynamic: requires sender IP: the mechanism cannot be resolved without the sender IP address.
• MX lookup limit exceeded: an mx mechanism required too many A/AAAA address lookups.