SPF
cloudflare.com
7 of 10 DNS lookups
Inside the limit, with 3 to spare.
Include tree
cloudflare.com6 lookups
v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all
_spf.google.com0 lookups
v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all
spf1.mcsv.net0 lookups
v=spf1 ip4:205.201.128.0/20 ip4:198.2.128.0/18 ?all
spf.mandrillapp.com0 lookups
v=spf1 ip4:198.2.128.0/24 ip4:198.2.132.0/22 ip4:198.2.136.0/23 ip4:198.2.145.0/24 ip4:198.2.186.0/23 ip4:205.201.131.0/24 ip4:205.201.134.128/25 ip4:205.201.136.0/23 ip4:205.201.139.0/24 ip4:198.2.177.0/24 ip4:198.2.178.0/23 ip4:198.2.180.0/24 ~all
mail.zendesk.com0 lookups
v=spf1 ip4:103.151.192.0/23 ip4:185.12.80.0/22 ip4:188.172.128.0/20 ip4:192.161.144.0/20 ip4:216.198.0.0/18 ~all
stspg-customer.com0 lookups
v=spf1 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146 ip4:23.253.183.147 ip4:23.253.183.148 ip4:23.253.183.150 ip4:166.78.68.221 ip4:167.89.46.159 ip4:167.89.64.9 ip4:167.89.65.0 ip4:167.89.65.53 ip4:167.89.65.100 ip4:167.89.74.233 ip4:167.89.75.33 ip4:167.89.75.126 ip4:167.89.75.136 ip4:167.89.75.164 ip4:192.237.159.42 ip4:192.237.159.43 ip4:159.112.242.162 ip4:159.135.228.10 ip4:198.244.56.107 ip4:198.244.56.108 ip4:198.244.56.109 ip4:198.244.56.111 ip4:198.244.56.112 ip4:198.244.56.113 ip4:198.244.56.114 ip4:198.244.56.115 ip4:204.220.181.105 ~all
_spf.salesforce.com1 lookup
v=spf1 exists:%{i}._spf.mta.salesforce.com -all
Every include: is followed. The count on each row is what that record spends on its own; the total is the sum of the whole tree, which is what a receiver actually charges you.
Flattened record
The same senders, with every include: replaced by the literal ranges it resolves to right now — 53 IPv4 and 6 IPv6 ranges, costing 1 lookup instead of 7.
v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip4:205.201.128.0/20 ip4:198.2.128.0/18 ip4:198.2.128.0/24 ip4:198.2.132.0/22 ip4:198.2.136.0/23 ip4:198.2.145.0/24 ip4:198.2.186.0/23 ip4:205.201.131.0/24 ip4:205.201.134.128/25 ip4:205.201.136.0/23 ip4:205.201.139.0/24 ip4:198.2.177.0/24 ip4:198.2.178.0/23 ip4:198.2.180.0/24 ip4:103.151.192.0/23 ip4:185.12.80.0/22 ip4:188.172.128.0/20 ip4:192.161.144.0/20 ip4:216.198.0.0/18 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146 ip4:23.253.183.147 ip4:23.253.183.148 ip4:23.253.183.150 ip4:166.78.68.221 ip4:167.89.46.159 ip4:167.89.64.9 ip4:167.89.65.0 ip4:167.89.65.53 ip4:167.89.65.100 ip4:167.89.74.233 ip4:167.89.75.33 ip4:167.89.75.126 ip4:167.89.75.136 ip4:167.89.75.164 ip4:192.237.159.42 ip4:192.237.159.43 ip4:159.112.242.162 ip4:159.135.228.10 ip4:198.244.56.107 ip4:198.244.56.108 ip4:198.244.56.109 ip4:198.244.56.111 ip4:198.244.56.112 ip4:198.244.56.113 ip4:198.244.56.114 ip4:198.244.56.115 ip4:204.220.181.105 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 exists:%{i}._spf.mta.salesforce.com -all
Flattening is a trade, not a free win. It freezes your providers' address ranges at this moment. When Google or Mailchimp next adds a sending range, their include: would have picked it up automatically and this copy will not — so mail from the new range fails SPF, quietly, weeks later. Use it when you have genuinely run out of lookups, and regenerate it whenever a provider changes.
This record is 1202 bytes. A single TXT string caps at 255, so your DNS host must split it into several strings — most do this automatically, but check that yours has.
Could not be flattened
exists:%{i}._spf.mta.salesforce.com
exists resolves at send time and cannot be replaced by a literal range here.
These are kept in the flattened record rather than dropped — removing them would remove a sender and break mail.
See DMARC, DKIM, registration and the rest for this domain.
Full report