Why does MXToolbox report SPF as too think while other tools show a higher score?
Summary
What email marketers say8Marketer opinions
Email marketer from StackOverflow explains that when an SPF record uses `include:` to reference another domain's SPF record, all the lookups required by that included record also count towards the original domain's 10-lookup limit. This can lead to exceeding the limit more easily.
Email marketer from WebHostingTalk Forum discusses that discrepancies in SPF results can be caused by DNS propagation delays, where some tools have updated information and others do not. They also point out the 10-lookup limit.
Email marketer from EmailOnAcid explains that complex SPF records with multiple includes and lookups can easily exceed the 10 DNS lookup limit. They advise simplifying the record by using IP addresses instead of domain names where possible.
Email marketer from EasyDMARC explains that different tools might evaluate SPF records differently due to variations in their configuration and testing methodologies. They highlight that MXToolbox is known to be very sensitive and thus may provide different outputs compared to other tools. Some tools may also cache results.
Email marketer from DKIMValidator.com shares that SPF records are limited to 10 DNS lookups. If this limit is exceeded, the SPF check will return a 'permerror'. They recommend flattening SPF records to avoid this issue.
Email marketer from Reddit user /u/mail-guy shares that some tools may follow redirects/includes further than others, leading to different lookup counts. MXToolbox might be more thorough.
Email marketer from GlockApps details how to check your SPF to make sure it doesn't go over the limit. It has to be done as some ESP's will automatically ignore any SPF check result that goes over the limit.
Email marketer from Mailhardener shares that differences in tool configuration, DNS resolution, and caching mechanisms can cause inconsistent results in SPF validation.
What the experts say3Expert opinions
Expert from Word to the Wise explains that exceeding the 10 DNS lookup limit will result in an SPF PermError, meaning a permanent error. This can occur if your SPF record has too many 'include:' statements or other mechanisms that require DNS lookups.
Expert from Email Geeks shares that there is new code in the pipeline to validate SPF correctly, but it’s not yet live on the web tool.
Expert from Email Geeks explains that one of the SPF lookups has exists:%{i}._<http://spf.mta.salesforce.com|spf.mta.salesforce.com> -all and that code doesn’t handle exists: well. She suggests using the DNS tab to see all the lookups and believes MXToolbox is probably right in this case.
What the documentation says5Technical articles
Documentation from OpenSPF.org details that the 'include' mechanism in SPF records counts towards the 10 DNS lookup limit. Excessive use of 'include' can lead to exceeding this limit.
Documentation from AuthSMTP describes that exceeding the SPF lookup limit will cause messages to fail SPF authentication. This will cause the SPF check to return a 'permerror'.
Documentation from RFC Editor explains that SPF implementations have a limit of 10 DNS lookups per SPF check. Exceeding this limit can cause SPF records to fail, even if syntactically correct.
Documentation from Microsoft explains about SPF and its limitation of 10 includes. If it goes over this, then you need to look at using a flattened SPF record.
Documentation from Google clarifies that SPF records that require more than 10 DNS lookups will result in a 'permerror' and may cause deliverability issues. They suggest streamlining SPF records to stay within the limit.