What each vendor costs in SPF lookups

Every number below was measured against live DNS with the same engine behind the SPF checker, not copied from a vendor's documentation. They are re-checked weekly, because they move.

Verified 2026-09-09. Was is the figure published on the older Expurgate list, kept because the movement is the point. Cheapest is the same vendor addressed by a single region.

Nearly every expensive record is expensive for one reason

A vendor operating in five regions publishes one headline include that fans out to all five. A customer sends from one of them. A receiving server walks all five anyway, on every message, because SPF has no way to know which region you are in.

Mimecast is the clearest case. Its published include contains nothing but five further includes, one per region, and costs nine of your ten lookups. The include for a single region costs one. Same authorised servers for your mail, eight lookups back.

The same shape appears in Freshdesk, Mailgun, NetSuite and Zoho. Across the vendors here that document their regional includes, narrowing each one to a single region gives back 20 lookups.

The numbers you have read elsewhere are probably wrong

Of the vendors on the older Expurgate list, re-measuring found most had changed since it was written, in both directions. Google Workspace fell from four lookups to one when it flattened its record, and nearly every guide still says four. Mimecast rose from six to nine. Mailgun, Zoho and NetSuite all grew.

Nothing announces this. A record that fitted comfortably last year can be over the limit today without anyone touching it, and the first symptom is mail from one vendor failing while everything else keeps working.

What to do with this

• Expand your own record before changing anything. A vendor's cost in isolation is not your total, and the limit applies to the whole evaluation. The include tree shows where yours goes.
• Narrow the fan-outs you can. Where a vendor documents a regional include, it is a supported change and usually the largest single saving available.
• Do not delete the cheap ones. Google Workspace and Microsoft 365 cost one lookup each and are the first includes people remove, because they are the ones they recognise.
• Move a heavy vendor to a subdomain, so its lookups come out of that subdomain's budget rather than your root domain's.
• Or hand over the record. SPF Guru reads the whole thing on your behalf and a receiving server performs one lookup, whatever sits behind it.

How these are measured

Each figure is the result of evaluating v=spf1 include:<target> -all against live DNS in audit mode, counting every DNS-resolving term including everything nested beneath it. That is the same count a receiving server applies against the limit of ten.

Audit mode keeps counting past ten rather than stopping there, which is why a record costing more than the limit can be reported honestly instead of as permerror.

A vendor missing from this list can be measured directly: put its include domain into the include tree and it will expand the same way.