Glossary
SPF include: Mechanism — Delegated Authorised Senders
The include: mechanism in an SPF record references another domain's SPF record as authorised to send on your behalf. When a receiver evaluates your SPF record and encounters include:sendgrid.net, it performs a DNS lookup on sendgrid.net's SPF record and adds those authorised IPs to yours. Each include: costs one DNS lookup toward the 10-lookup limit.
Common include: Values
Google Workspace: include:_spf.google.com Microsoft 365: include:spf.protection.outlook.com SendGrid: include:sendgrid.net Mailgun: include:mailgun.org Postmark: include:spf.mtasv.net
The Lookup Cost
Each include: triggers one DNS lookup. Most providers nest their own includes — so include:sendgrid.net may cost 3-4 lookups total. Add enough providers and you exceed the 10-lookup limit.
Count SPF lookups
Open DNS Preflight →FAQ
What does include: do in an SPF record?
References another domain's SPF record as authorised for your domain. Receivers check the included domain's SPF and add those IPs to your authorised senders.
How many include: statements can I have?
As many as you want — but each costs DNS lookups. You must stay under 10 total lookups. Use DNS Preflight to count yours.
What happens if I have too many includes?
SPF PermError — receivers can't evaluate your record and may reject or spam-folder your email.