SPF that never trips the 10-lookup limit
Add a few cloud senders and your SPF record quietly blows past the 10-DNS-lookup limit - and starts failing. DMARCER hosts your SPF and keeps it flat and valid automatically, with a preview before anything changes and a one-click way back.
DNS-lookup limit we keep you under
Record you set – we host the rest
Re-flattened as your senders change
The silent SPF failure
SPF – the record that lists who’s allowed to send mail as your domain – comes with a hard rule baked into the standard: a receiving mail server is only allowed to follow 10 DNS lookups while checking it. Every include: you add for a cloud service (your mail platform, your CRM, your helpdesk, your invoicing tool) spends part of that budget, and a single include can itself pull in several more lookups behind the scenes.
Cross the limit and SPF doesn’t warn you – it returns permerror, and many receivers treat that as a failure. The worst part is how it happens: gradually and invisibly, as you adopt one more tool, until one day legitimate mail is failing authentication and nobody changed anything obvious. It’s one of the most common reasons a perfectly reasonable SPF record quietly stops working.
Why this matters – whoever you are
- Running your own domains? You stop policing a lookup budget by hand every time you add a tool.
- Managing clients? You take a recurring, hard-to-spot failure mode off the table across every client at once.
Set one record. We keep it flat.
Instead of stacking up includes, you point a single include at DMARCER. We then publish a flattened SPF record – one where each sender has been resolved down to the actual IP addresses it sends from, rather than another include that costs more lookups. The result is a record that authorises all your senders while sitting comfortably under the 10-lookup limit.
Flattening once would be easy; the hard part is that those underlying IPs change – providers add and retire servers all the time. So DMARCER doesn’t flatten once and walk away: it re-resolves your senders and republishes the record automatically as their IPs move. Your SPF just stays correct, with no maintenance from you.
- One include – we host the rest
- Senders resolved to underlying IPs, well under 10 lookups
- Re-resolved and republished automatically as IPs change
- No manual editing every time a provider shifts
Built to scale across thousands of domains
Hosting one record is simple; hosting them for an entire client base without records colliding or going stale is the real engineering. DMARCER uses a multi-zone design so each domain gets its own correctly-maintained record, and the same automatic re-resolution runs across all of them – whether you’re looking after one domain or thousands.
Multi-zone
A design that keeps every domain’s record separate and independently maintained, so scale never turns into one fragile shared record.
Always current
Automatic re-resolution runs across the whole estate, so no domain quietly drifts out of date while you’re looking at another.
Drift detection
If an upstream sender goes dark – stops resolving to any IPs – DMARCER notices, so a vanished sender is surfaced rather than silently dropped.
Reversible, with a preview before you commit
Changing your SPF record is changing live DNS, and nothing here happens blindly. Before you flip anything, you see the exact record DMARCER will publish – no guessing what landed. Your original record is snapshotted and retained the whole time, so the starting point is never lost.
And if you ever want to walk it back, one click hands you an equivalent record to republish – you’re returned to where you were, not stranded. There’s no lock-in and no dead end: hosting your SPF with DMARCER is a decision you can always reverse.
- Preview the exact flattened record before going live
- Your original record snapshotted and retained
- One-click revert hands back an equivalent record
- No lock-in – a reversible decision, start to finish
If you run your own domains
You add cloud tools freely without ever counting lookups or breaking SPF – one include points at DMARCER, the record stays flat and current, and you can preview and revert any change yourself.
If you manage clients
You retire a whole class of silent SPF failures across every client at once, on a multi-zone design that scales – with drift detection flagging vanished senders and a clean way back if a client ever wants out.
Where this fits in the platform
Source identification →
Know which senders belong in your SPF.
Enforcement journey →
A valid SPF record is groundwork for enforcement.
Forensic analysis →
See SPF results behind every failing message.
For MSPs →
Host SPF for every client you manage.
How many lookups is your SPF using?
Run a free check to see your SPF record and lookup count – then host it with DMARCER and stop worrying about the limit.
Check your domain