Vendor lookup costs

Microsoft 365 and the SPF lookup limit

One lookup, and it has always been one. Not the cause of your PermError.

include:spf.protection.outlook.com is a flat list of ip4 and ip6 ranges. No nested includes, no regional fan-out, one DNS lookup. It is the cheapest way a platform of that size could publish itself.

It is also the include people delete first when a record is over the limit, because it is the one they recognise. Removing it saves a single lookup and stops authorising every message your organisation sends.

If your record is over ten terms, the cost is somewhere else. A single regional fan-out from a helpdesk or a security gateway routinely costs five to nine on its own.

What to do

• Leave it alone, and do not let a checker's suggestion list talk you into removing it.
• Expand the full record and look for the includes that resolve to further includes. That is where a budget goes.

Check your own record

These numbers are what the include costs on its own. What matters is the total across your whole record, because the ten term limit applies to the evaluation, not to any one vendor.

Expand spf.protection.outlook.com and you will find nothing nested inside it at all: the record is a flat list of addresses. Its single lookup is the include: that reaches it.

Check your own domain to see what the whole record costs and get a replacement that fits.

Related

• Google Workspace — 1 lookup
• Mimecast — 9 lookups
• Every vendor we measure