icloud.com SPF include tree: 4 DNS lookups

Expand a domain's SPF record and see where its DNS lookups actually go. Every nested include is walked, and each branch shows what it costs in total, so you can tell which one is eating the budget.

4 of 10 lookups

icloud.com is within the limit.

redirect=_spf.icloud.com accounts for 4 of those 4 lookups. If you need to save room, that is where to start: offload one vendor or move it to a subdomain.

The record, expanded

icloud.com
v=spf1 redirect=_spf.icloud.com
- redirect=_spf.icloud.com 4 lookups
  - _spf.icloud.com
    v=spf1 include:_nets2.icloud.com include:_nets1.icloud.com include:_nets0.icloud.com ~all
    - include:_nets2.icloud.com 1 lookup
      - _nets2.icloud.com
        v=spf1 ip4:57.103.64.0/18 ip6:2a01:b747:3000:200::/56 ip6:2a01:b747:3001:200::/56 ip6:2a01:b747:3002:200::/56 ip6:2a01:b747:3003:200::/56 ip6:2a01:b747:3004:200::/56 ip6:2a01:b747:3005:200::/56 ip6:2a01:b747:3006:200::/56 ip6:2a01:b747:3007::/56
        
        ip4:57.103.64.0/18
        
        ip6:2a01:b747:3000:200::/56
        
        ip6:2a01:b747:3001:200::/56
        
        ip6:2a01:b747:3002:200::/56
        
        ip6:2a01:b747:3003:200::/56
        
        ip6:2a01:b747:3004:200::/56
        
        ip6:2a01:b747:3005:200::/56
        
        ip6:2a01:b747:3006:200::/56
        
        ip6:2a01:b747:3007::/56
    - include:_nets1.icloud.com 1 lookup
      - _nets1.icloud.com
        v=spf1 ip4:144.178.36.0/24 ip4:144.178.38.0/24 ip4:112.19.199.64/29 ip4:112.19.242.64/29 ip4:222.73.195.64/29 ip4:157.255.1.64/29 ip4:106.39.212.64/29 ip4:123.126.78.64/29 ip4:183.240.219.64/29 ip4:39.156.163.64/29
        
        ip4:144.178.36.0/24
        
        ip4:144.178.38.0/24
        
        ip4:112.19.199.64/29
        
        ip4:112.19.242.64/29
        
        ip4:222.73.195.64/29
        
        ip4:157.255.1.64/29
        
        ip4:106.39.212.64/29
        
        ip4:123.126.78.64/29
        
        ip4:183.240.219.64/29
        
        ip4:39.156.163.64/29
    - include:_nets0.icloud.com 1 lookup
      - _nets0.icloud.com
        v=spf1 ip4:17.41.0.0/16 ip4:17.58.0.0/16 ip4:17.142.0.0/15 ip4:17.57.155.0/24 ip4:17.57.156.0/24
        
        ip4:17.41.0.0/16
        
        ip4:17.58.0.0/16
        
        ip4:17.142.0.0/15
        
        ip4:17.57.155.0/24
        
        ip4:17.57.156.0/24
    - ~all

Counts include everything nested beneath a branch, which is how the ten lookup limit is actually applied. To generate a replacement record, check this domain on the home page.