{"id":62654,"date":"2026-06-23T20:52:38","date_gmt":"2026-06-23T20:52:38","guid":{"rendered":"https:\/\/easydmarc.com\/blog\/?p=62654"},"modified":"2026-06-23T20:52:42","modified_gmt":"2026-06-23T20:52:42","slug":"spf-include-mechanism","status":"publish","type":"post","link":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/","title":{"rendered":"What Does SPF Include Mean and How Does It Work?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The SPF includes a mechanism that is an SPF authorization method that delegates sender validation to another domain&#8217;s SPF record. When an SPF record contains an include: statement, receiving mail servers query the referenced domain\u2019s SPF record during SPF evaluation to verify whether the sending IP address is authorized. This is commonly used in environments where multiple platforms, such as email service providers, CRMs, ticketing systems, and cloud communication tools, send mail from the same domain.<\/p>\n\n\n\n<h2 id=\"h-what-is-the-spf-include-mechanism\" class=\"wp-block-heading\">What Is the SPF Include Mechanism?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In SPF syntax, the include: mechanism delegates sender validation to a referenced domain&#8217;s SPF record. When a receiving mail server encounters an include: statement, it performs an additional <a href=\"https:\/\/easydmarc.com\/tools\/dns-record-checker\">DNS lookup<\/a> against that domain&#8217;s published SPF policy and evaluates whether the sending IP address is authorized there.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">v=spf1 include:spf.protection.outlook.com include:_spf.google.com ~all<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this case, the domain owner authorizes Microsoft 365 and Google Workspace to send email on behalf of the domain by referencing their SPF records directly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the sending IP address matches the SPF policy published by the included domain, the include evaluation returns a pass result. If no match is found, SPF evaluation continues with the remaining mechanisms in the record.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The include: mechanism does not copy or merge another SPF record into the current one. Instead, it instructs the receiving mail server to recursively evaluate the referenced SPF policy during authentication.<\/p>\n\n\n\n<h2 id=\"h-how-the-spf-include-mechanism-works-step-by-step\" class=\"wp-block-heading\">How the SPF Include Mechanism Works Step by Step<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When a receiving mail server processes an SPF record, it evaluates every mechanism in sequence to determine whether the sending IP address is authorized to send mail for the domain. If the record contains one or more include: statements, the server must recursively query additional SPF records as part of the evaluation process. This lookup chain continues until SPF returns a final authentication result or reaches the lookup limit defined in RFC 7208.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"576\" height=\"1024\" src=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/infographic_1-1-576x1024.jpeg\" alt=\"How the SPF Include Mechanism Works Step by Step\" class=\"wp-image-62655\" srcset=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/infographic_1-1-576x1024.jpeg 576w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/infographic_1-1-169x300.jpeg 169w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/infographic_1-1.jpeg 720w\" sizes=\"(max-width: 576px) 100vw, 576px\" \/><\/figure>\n<\/div>\n\n\n<h3 id=\"h-1-a-receiving-mail-server-initiates-an-spf-check\" class=\"wp-block-heading\">1. A receiving mail server initiates an SPF check<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When an email message is received, the destination mail server starts SPF evaluation by retrieving the sender domain\u2019s SPF record from DNS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">v=spf1 include:_spf.examplevendor.com ip4:192.0.2.10 ~all<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The server evaluates each mechanism in sequence to determine whether the sending IP address is authorized to send mail for the domain.<\/p>\n\n\n\n<h3 id=\"h-2-the-server-encounters-an-include-mechanism\" class=\"wp-block-heading\">2. The server encounters an include: mechanism<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When the SPF evaluator reaches an include: statement, it performs an additional lookup against the referenced domain\u2019s SPF record.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">include:_spf.examplevendor.com<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This tells the receiving server to retrieve and evaluate the SPF policy published by _spf.examplevendor.com.<\/p>\n\n\n\n<h3 id=\"h-3-the-referenced-spf-record-is-evaluated\" class=\"wp-block-heading\">3. The referenced SPF record is evaluated<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The receiving server checks whether the sending IP address matches any authorized mechanism inside the included SPF record.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example referenced record:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">v=spf1 ip4:198.51.100.0\/24 include:_spf.mailprovider.net -all<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the sending IP matches one of the authorized ranges or mechanisms, the include evaluation returns a pass.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the sending IP does not match, SPF processing continues with the remaining mechanisms in the original SPF record.<\/p>\n\n\n\n<h3 id=\"h-4-nested-include-statements-trigger-additional-lookups\" class=\"wp-block-heading\">4. Nested include: statements trigger additional lookups<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Included SPF records can contain their own include: mechanisms. This creates a recursive DNS lookup chain during SPF evaluation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">v=spf1 include:_spf.vendor-a.com include:_spf.vendor-b.com ~all<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If either referenced record contains additional nested includes, the receiving server must continue querying those domains as part of SPF processing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each include: mechanism counts toward the SPF DNS lookup limit defined in RFC 7208.<\/p>\n\n\n\n<h3 id=\"h-5-spf-evaluation-stops-after-a-final-result\" class=\"wp-block-heading\">5. SPF evaluation stops after a final result<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">SPF evaluation ends when a mechanism produces a final result or when processing returns an error, such as PermError.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><a href=\"https:\/\/app.easydmarc.com\/register\"><img decoding=\"async\" width=\"1024\" height=\"257\" src=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/03\/Frame-1686560626-1-1024x257.jpg\" alt=\"free DMARC look up tool\" class=\"wp-image-59620\" srcset=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/03\/Frame-1686560626-1-1024x257.jpg 1024w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/03\/Frame-1686560626-1-300x75.jpg 300w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/03\/Frame-1686560626-1-768x192.jpg 768w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/03\/Frame-1686560626-1-1536x385.jpg 1536w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/03\/Frame-1686560626-1-1200x301.jpg 1200w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/03\/Frame-1686560626-1.jpg 1544w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n<\/div>\n\n\n<h2 id=\"h-when-to-use-include-in-an-spf-record\" class=\"wp-block-heading\">When to Use Include in an SPF Record<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Organizations use the include: mechanism when multiple third-party platforms send email on behalf of the same domain. This commonly includes email marketing providers, CRMs, customer support platforms, ticketing systems, cloud communication services, and internal business applications.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of manually maintaining large lists of IP addresses, administrators can reference the SPF policies published by those providers directly within their own SPF record. This allows authorized sending infrastructure to stay aligned with the provider\u2019s published SPF configuration as their infrastructure changes over time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A typical enterprise SPF record may include several authorized sending sources simultaneously:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:servers.mcsv.net ~all<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In multi-sender environments, SPF configuration becomes an operational governance task rather than a one-time DNS update. Each additional sender increases SPF evaluation complexity and contributes to the total DNS lookup count.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Before adding a new include: statement, administrators should review the existing SPF record structure, nested lookup depth, and overall lookup usage to avoid authentication failures caused by exceeding SPF processing limits.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Platforms such as EasyDMARC help surface observed sending sources from aggregate DMARC reporting data, so administrators can compare active mail sources against their SPF configuration.<\/p>\n\n\n\n<h2 id=\"h-spf-record-multiple-include-managing-more-than-one-sending-source\" class=\"wp-block-heading\">SPF Record Multiple Include: Managing More Than One Sending Source<\/h2>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" width=\"1024\" height=\"683\" src=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/infographic_2-1-1-1024x683.jpeg\" alt=\"mechanisms that count toward the spf 10-lookup limit \" class=\"wp-image-62656\" srcset=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/infographic_2-1-1-1024x683.jpeg 1024w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/infographic_2-1-1-300x200.jpeg 300w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/infographic_2-1-1-768x512.jpeg 768w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/infographic_2-1-1-1200x800.jpeg 1200w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/infographic_2-1-1.jpeg 1536w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Most enterprise SPF records contain multiple include: statements because organizations rely on several platforms to send email from the same domain. Marketing automation systems, cloud email providers, customer support platforms, and transactional email services often all require SPF authorization simultaneously.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:servers.mcsv.net include:sendgrid.net ~all<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each include: is a mechanism that triggers at least one DNS lookup during SPF evaluation. In many cases, SPF records include additional nested includes, redirects, or DNS-resolving mechanisms that increase the total lookup count further.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">RFC 7208 enforces a hard limit of 10 DNS-resolving mechanisms during SPF processing. This includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>include<\/li>\n\n\n\n<li>a<\/li>\n\n\n\n<li>mx<\/li>\n\n\n\n<li>ptr<\/li>\n\n\n\n<li>exists<\/li>\n\n\n\n<li>redirect<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If SPF evaluation exceeds this limit, the receiving mail server returns a PermError result. Depending on the recipient infrastructure and mail policy enforcement, legitimate email may fail SPF authentication as a result.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is not an uncommon edge case in modern email environments. Organizations frequently accumulate additional sending services over time without restructuring existing SPF policies, which can create deeply nested SPF lookup chains.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Administrators managing complex SPF records should regularly audit all active sending sources, remove unused include chains, and validate lookup depth before onboarding additional email platforms.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><a href=\"https:\/\/easydmarc.com\/contact-us\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"256\" src=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560624-1024x256.jpg\" alt=\"Need help with DMARC?\" class=\"wp-image-62184\" srcset=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560624-1024x256.jpg 1024w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560624-300x75.jpg 300w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560624-768x192.jpg 768w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560624-1536x384.jpg 1536w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560624-1200x300.jpg 1200w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560624.jpg 1544w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n<\/div>\n\n\n<h2 id=\"h-spf-permerror-and-the-invalid-include-mechanism-warning\" class=\"wp-block-heading\">SPF PermError and the Invalid include: Mechanism Warning<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In SPF evaluation, a PermError indicates that the receiving mail server encountered a permanent error while processing the SPF record. One common example is an <a href=\"https:\/\/easydmarc.com\/blog\/spf-too-many-dns-lookups-error\">SPF PermError<\/a> triggered by an invalid or unresolvable include: mechanism.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This error typically appears when an include: statement references a domain that:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>does not exist<\/li>\n\n\n\n<li>has no valid SPF record<\/li>\n\n\n\n<li>contains invalid SPF syntax<\/li>\n\n\n\n<li>publishes a malformed SPF policy<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">v=spf1 include:invalid-domain.example ~all<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this scenario, the receiving server cannot successfully evaluate the referenced SPF policy, which causes SPF processing to return a permanent error.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This issue is different from the PermError triggered by exceeding the 10 DNS lookup limit. The lookup-limit error occurs during SPF recursion depth evaluation, while this type of PermError is usually tied to invalid SPF syntax or broken include targets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Before publishing SPF changes, administrators should validate every referenced include: domain to confirm that the target SPF record exists and can be resolved correctly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Using an SPF checker helps identify invalid include chains, syntax issues, and SPF evaluation errors before deployment.<\/p>\n\n\n\n<h2 id=\"h-how-easydmarc-helps-you-manage-spf-include-at-scale\" class=\"wp-block-heading\">How EasyDMARC Helps You Manage SPF Include at Scale<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Managing SPF includes chains across multiple business systems becomes increasingly difficult as organizations add new sending sources over time. Marketing platforms, internal applications, cloud email providers, and support tools can all contribute to SPF complexity and DNS lookup growth.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">EasyDMARC provides visibility into how these sending sources interact with SPF authentication policies. The platform analyzes aggregate DMARC reporting data to surface active sending services associated with a domain. Administrators can then compare observed sending sources against their SPF configuration to identify gaps or unauthorized senders.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The dashboard displays observed sending sources and SPF alignment results from aggregate DMARC report data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">EasyDMARC also provides tools that support SPF configuration review and validation workflows:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/easydmarc.com\/tools\/spf-lookup\">SPF Lookup<\/a> helps validate SPF records, inspect include chains, and identify syntax or lookup-related issues.<\/li>\n\n\n\n<li><a href=\"https:\/\/easydmarc.com\/tools\/spf-record-generator\">SPF Record Generator<\/a> helps administrators build and structure SPF records for multiple authorized sending sources.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For organizations managing complex email ecosystems, the platform provides centralized reporting and configuration visibility that supports ongoing SPF governance and maintenance.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><a href=\"https:\/\/app.easydmarc.com\/register\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"257\" src=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560623-1-1-1024x257.jpg\" alt=\"Try EasyDMARC for free\" class=\"wp-image-62185\" srcset=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560623-1-1-1024x257.jpg 1024w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560623-1-1-300x75.jpg 300w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560623-1-1-768x192.jpg 768w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560623-1-1-1536x385.jpg 1536w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560623-1-1-1200x301.jpg 1200w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/05\/Frame-1686560623-1-1.jpg 1544w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n<\/div>\n\n\n<h2 id=\"h-frequently-asked-questions\" class=\"wp-block-heading\">Frequently Asked Questions<\/h2>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1782247685886\"><strong class=\"schema-faq-question\">What does SPF include mean and how does it work?<\/strong> <p class=\"schema-faq-answer\">The include: mechanism in an SPF record delegates SPF authorization to another domain\u2019s SPF policy. When a receiving mail server encounters include:domain.com, it performs a DNS lookup against that domain\u2019s SPF record and evaluates whether the sending IP address is authorized there. This approach is commonly used when third party services such as email marketing platforms, CRMs, or support systems send emails on behalf of your domain. The include: mechanism does not copy another SPF record into your own. Instead, it tells the receiving server to recursively evaluate the referenced SPF policy during SPF authentication.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1782247697798\"><strong class=\"schema-faq-question\">How many include: statements can I have in an SPF record?<\/strong> <p class=\"schema-faq-answer\">There is no fixed limit on the number of include: statements allowed in an SPF record itself. However, RFC 7208 limits SPF evaluation to a maximum of 10 DNS-resolving lookups during processing. Each include: mechanism counts toward that limit, and nested includes inside referenced SPF records also contribute to the total. If SPF evaluation exceeds the lookup threshold, the receiving server returns a PermError result. Organizations using multiple third party email platforms should regularly audit SPF lookup depth to avoid authentication issues caused by excessive include chains and recursive DNS lookups.\u00a0<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1782247725547\"><strong class=\"schema-faq-question\">What causes SPF permerror illegal mechanism include?<\/strong> <p class=\"schema-faq-answer\">The spf permerror illegal mechanism include warning that usually appears when an include: statement references a domain with an invalid or unusable SPF configuration. This can happen if the referenced domain does not exist, publishes no SPF record, contains malformed SPF syntax, or returns an invalid response during evaluation. This issue differs from the PermError caused by exceeding the 10 DNS lookup limit. In this case, the receiving mail server cannot properly interpret or evaluate the included SPF policy. Administrators should validate all included targets before publishing SPF changes to avoid permanent SPF evaluation failures.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1782247749964\"><strong class=\"schema-faq-question\">Should I use include: or add IPs directly to my SPF record?<\/strong> <p class=\"schema-faq-answer\">Using include: is typically recommended when third party services manage their own sending infrastructure and publish SPF records for customers to reference. This allows providers to update authorized IP addresses without requiring manual SPF changes on your side. Direct IP entries may be appropriate for internally managed mail servers or static sending infrastructure that rarely changes. In enterprise environments, SPF records often contain a combination of direct IP mechanisms and include: statements. Administrators should balance operational flexibility, DNS lookup usage, and long-term SPF maintainability when deciding how to structure SPF authorization policies.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1782247827140\"><strong class=\"schema-faq-question\">How do I fix an SPF record that exceeds the 10 DNS lookup limit?<\/strong> <p class=\"schema-faq-answer\">Start by auditing your current SPF record to count all DNS-resolving mechanisms, including nested includes inside referenced third-party SPF records. Remove any include: statements for sending services your organization no longer uses. Where possible, consolidate multiple include: references from the same provider into a single authorized entry. For remaining services, check whether the provider offers a flattened or optimized SPF record that resolves fewer lookups. If lookup depth remains a concern after cleanup, SPF flattening tools can reduce recursive evaluation by substituting include chains with resolved IP ranges, though this requires ongoing maintenance as provider infrastructure changes. EasyDMARC&#8217;s SPF checker surfaces lookup depth and chain structure so administrators can identify which include: references are contributing most to the total count.<\/p> <\/div> <\/div>\n","protected":false},"excerpt":{"rendered":"<p>The SPF includes a mechanism that is an &#8230;<\/p>\n","protected":false},"author":58,"featured_media":62657,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[204,291,203,286],"tags":[],"class_list":["post-62654","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","category-email-authentication","category-email-security","category-spf"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.8 (Yoast SEO v27.8) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>What Does SPF Include Mean and How Does It Work? | EasyDMARC<\/title>\n<meta name=\"description\" content=\"SPF include lets you authorize third-party senders in your SPF record. Learn how it works, when to use it, and how to avoid lookup limits and PermError.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Does SPF Include Mean and How Does It Work?\" \/>\n<meta property=\"og:description\" content=\"SPF include lets you authorize third-party senders in your SPF record. Learn how it works, when to use it, and how to avoid lookup limits and PermError.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/\" \/>\n<meta property=\"og:site_name\" content=\"EasyDMARC\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/EasyDMARC\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-23T20:52:38+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-23T20:52:42+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/SPF-Hero-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1440\" \/>\n\t<meta property=\"og:image:height\" content=\"910\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Ruben Khachatryan\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@easydmarc\" \/>\n<meta name=\"twitter:site\" content=\"@easydmarc\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ruben Khachatryan\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/\"},\"author\":{\"name\":\"Ruben Khachatryan\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#\\\/schema\\\/person\\\/9766f07d4ef9704ee4f6810b32788c1c\"},\"headline\":\"What Does SPF Include Mean and How Does It Work?\",\"datePublished\":\"2026-06-23T20:52:38+00:00\",\"dateModified\":\"2026-06-23T20:52:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/\"},\"wordCount\":1932,\"publisher\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/SPF-Hero-1.png\",\"articleSection\":[\"Blog\",\"Email Authentication\",\"Email Security\",\"SPF\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#respond\"]}]},{\"@type\":[\"WebPage\",\"FAQPage\"],\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/\",\"url\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/\",\"name\":\"What Does SPF Include Mean and How Does It Work? | EasyDMARC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/SPF-Hero-1.png\",\"datePublished\":\"2026-06-23T20:52:38+00:00\",\"dateModified\":\"2026-06-23T20:52:42+00:00\",\"description\":\"SPF include lets you authorize third-party senders in your SPF record. Learn how it works, when to use it, and how to avoid lookup limits and PermError.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#breadcrumb\"},\"mainEntity\":[{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247685886\"},{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247697798\"},{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247725547\"},{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247749964\"},{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247827140\"}],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#primaryimage\",\"url\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/SPF-Hero-1.png\",\"contentUrl\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/SPF-Hero-1.png\",\"width\":1440,\"height\":910,\"caption\":\"What Does SPF Include Mean and How Does It Work?\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/easydmarc.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/category\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"What Does SPF Include Mean and How Does It Work?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/\",\"name\":\"EasyDMARC\",\"description\":\"Blog\",\"publisher\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/#organization\",\"name\":\"EasyDMARC\",\"url\":\"https:\\\/\\\/easydmarc.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/easydmarc.com\\\/img\\\/logo.png\"},\"image\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/EasyDMARC\\\/\",\"https:\\\/\\\/x.com\\\/easydmarc\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/easydmarc\\\/mycompany\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#\\\/schema\\\/person\\\/9766f07d4ef9704ee4f6810b32788c1c\",\"name\":\"Ruben Khachatryan\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5f27eee0b7b7d4f7b6d1b4b7a485211ddd89e0e9205459180fc36e502b22ee12?s=96&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5f27eee0b7b7d4f7b6d1b4b7a485211ddd89e0e9205459180fc36e502b22ee12?s=96&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5f27eee0b7b7d4f7b6d1b4b7a485211ddd89e0e9205459180fc36e502b22ee12?s=96&r=g\",\"caption\":\"Ruben Khachatryan\"},\"url\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/author\\\/ruben\\\/\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247685886\",\"position\":1,\"url\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247685886\",\"name\":\"What does SPF include mean and how does it work?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The include: mechanism in an SPF record delegates SPF authorization to another domain\u2019s SPF policy. When a receiving mail server encounters include:domain.com, it performs a DNS lookup against that domain\u2019s SPF record and evaluates whether the sending IP address is authorized there. This approach is commonly used when third party services such as email marketing platforms, CRMs, or support systems send emails on behalf of your domain. The include: mechanism does not copy another SPF record into your own. Instead, it tells the receiving server to recursively evaluate the referenced SPF policy during SPF authentication.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247697798\",\"position\":2,\"url\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247697798\",\"name\":\"How many include: statements can I have in an SPF record?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"There is no fixed limit on the number of include: statements allowed in an SPF record itself. However, RFC 7208 limits SPF evaluation to a maximum of 10 DNS-resolving lookups during processing. Each include: mechanism counts toward that limit, and nested includes inside referenced SPF records also contribute to the total. If SPF evaluation exceeds the lookup threshold, the receiving server returns a PermError result. Organizations using multiple third party email platforms should regularly audit SPF lookup depth to avoid authentication issues caused by excessive include chains and recursive DNS lookups.\u00a0\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247725547\",\"position\":3,\"url\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247725547\",\"name\":\"What causes SPF permerror illegal mechanism include?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The spf permerror illegal mechanism include warning that usually appears when an include: statement references a domain with an invalid or unusable SPF configuration. This can happen if the referenced domain does not exist, publishes no SPF record, contains malformed SPF syntax, or returns an invalid response during evaluation. This issue differs from the PermError caused by exceeding the 10 DNS lookup limit. In this case, the receiving mail server cannot properly interpret or evaluate the included SPF policy. Administrators should validate all included targets before publishing SPF changes to avoid permanent SPF evaluation failures.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247749964\",\"position\":4,\"url\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247749964\",\"name\":\"Should I use include: or add IPs directly to my SPF record?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Using include: is typically recommended when third party services manage their own sending infrastructure and publish SPF records for customers to reference. This allows providers to update authorized IP addresses without requiring manual SPF changes on your side. Direct IP entries may be appropriate for internally managed mail servers or static sending infrastructure that rarely changes. In enterprise environments, SPF records often contain a combination of direct IP mechanisms and include: statements. Administrators should balance operational flexibility, DNS lookup usage, and long-term SPF maintainability when deciding how to structure SPF authorization policies.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247827140\",\"position\":5,\"url\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/spf-include-mechanism\\\/#faq-question-1782247827140\",\"name\":\"How do I fix an SPF record that exceeds the 10 DNS lookup limit?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Start by auditing your current SPF record to count all DNS-resolving mechanisms, including nested includes inside referenced third-party SPF records. Remove any include: statements for sending services your organization no longer uses. Where possible, consolidate multiple include: references from the same provider into a single authorized entry. For remaining services, check whether the provider offers a flattened or optimized SPF record that resolves fewer lookups. If lookup depth remains a concern after cleanup, SPF flattening tools can reduce recursive evaluation by substituting include chains with resolved IP ranges, though this requires ongoing maintenance as provider infrastructure changes. EasyDMARC's SPF checker surfaces lookup depth and chain structure so administrators can identify which include: references are contributing most to the total count.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"What Does SPF Include Mean and How Does It Work? | EasyDMARC","description":"SPF include lets you authorize third-party senders in your SPF record. Learn how it works, when to use it, and how to avoid lookup limits and PermError.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/","og_locale":"en_US","og_type":"article","og_title":"What Does SPF Include Mean and How Does It Work?","og_description":"SPF include lets you authorize third-party senders in your SPF record. Learn how it works, when to use it, and how to avoid lookup limits and PermError.","og_url":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/","og_site_name":"EasyDMARC","article_publisher":"https:\/\/www.facebook.com\/EasyDMARC\/","article_published_time":"2026-06-23T20:52:38+00:00","article_modified_time":"2026-06-23T20:52:42+00:00","og_image":[{"width":1440,"height":910,"url":"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/SPF-Hero-1.png","type":"image\/png"}],"author":"Ruben Khachatryan","twitter_card":"summary_large_image","twitter_creator":"@easydmarc","twitter_site":"@easydmarc","twitter_misc":{"Written by":"Ruben Khachatryan","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#article","isPartOf":{"@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/"},"author":{"name":"Ruben Khachatryan","@id":"https:\/\/easydmarc.com\/blog\/#\/schema\/person\/9766f07d4ef9704ee4f6810b32788c1c"},"headline":"What Does SPF Include Mean and How Does It Work?","datePublished":"2026-06-23T20:52:38+00:00","dateModified":"2026-06-23T20:52:42+00:00","mainEntityOfPage":{"@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/"},"wordCount":1932,"publisher":{"@id":"https:\/\/easydmarc.com\/blog\/#organization"},"image":{"@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#primaryimage"},"thumbnailUrl":"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/SPF-Hero-1.png","articleSection":["Blog","Email Authentication","Email Security","SPF"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#respond"]}]},{"@type":["WebPage","FAQPage"],"@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/","url":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/","name":"What Does SPF Include Mean and How Does It Work? | EasyDMARC","isPartOf":{"@id":"https:\/\/easydmarc.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#primaryimage"},"image":{"@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#primaryimage"},"thumbnailUrl":"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/SPF-Hero-1.png","datePublished":"2026-06-23T20:52:38+00:00","dateModified":"2026-06-23T20:52:42+00:00","description":"SPF include lets you authorize third-party senders in your SPF record. Learn how it works, when to use it, and how to avoid lookup limits and PermError.","breadcrumb":{"@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#breadcrumb"},"mainEntity":[{"@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247685886"},{"@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247697798"},{"@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247725547"},{"@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247749964"},{"@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247827140"}],"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#primaryimage","url":"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/SPF-Hero-1.png","contentUrl":"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/SPF-Hero-1.png","width":1440,"height":910,"caption":"What Does SPF Include Mean and How Does It Work?"},{"@type":"BreadcrumbList","@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/easydmarc.com\/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https:\/\/easydmarc.com\/blog\/category\/blog\/"},{"@type":"ListItem","position":3,"name":"What Does SPF Include Mean and How Does It Work?"}]},{"@type":"WebSite","@id":"https:\/\/easydmarc.com\/blog\/#website","url":"https:\/\/easydmarc.com\/blog\/","name":"EasyDMARC","description":"Blog","publisher":{"@id":"https:\/\/easydmarc.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/easydmarc.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/easydmarc.com\/#organization","name":"EasyDMARC","url":"https:\/\/easydmarc.com\/","logo":{"@type":"ImageObject","url":"https:\/\/easydmarc.com\/img\/logo.png"},"image":{"@id":"https:\/\/easydmarc.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/EasyDMARC\/","https:\/\/x.com\/easydmarc","https:\/\/www.linkedin.com\/company\/easydmarc\/mycompany\/"]},{"@type":"Person","@id":"https:\/\/easydmarc.com\/blog\/#\/schema\/person\/9766f07d4ef9704ee4f6810b32788c1c","name":"Ruben Khachatryan","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/5f27eee0b7b7d4f7b6d1b4b7a485211ddd89e0e9205459180fc36e502b22ee12?s=96&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/5f27eee0b7b7d4f7b6d1b4b7a485211ddd89e0e9205459180fc36e502b22ee12?s=96&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5f27eee0b7b7d4f7b6d1b4b7a485211ddd89e0e9205459180fc36e502b22ee12?s=96&r=g","caption":"Ruben Khachatryan"},"url":"https:\/\/easydmarc.com\/blog\/author\/ruben\/"},{"@type":"Question","@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247685886","position":1,"url":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247685886","name":"What does SPF include mean and how does it work?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"The include: mechanism in an SPF record delegates SPF authorization to another domain\u2019s SPF policy. When a receiving mail server encounters include:domain.com, it performs a DNS lookup against that domain\u2019s SPF record and evaluates whether the sending IP address is authorized there. This approach is commonly used when third party services such as email marketing platforms, CRMs, or support systems send emails on behalf of your domain. The include: mechanism does not copy another SPF record into your own. Instead, it tells the receiving server to recursively evaluate the referenced SPF policy during SPF authentication.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247697798","position":2,"url":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247697798","name":"How many include: statements can I have in an SPF record?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"There is no fixed limit on the number of include: statements allowed in an SPF record itself. However, RFC 7208 limits SPF evaluation to a maximum of 10 DNS-resolving lookups during processing. Each include: mechanism counts toward that limit, and nested includes inside referenced SPF records also contribute to the total. If SPF evaluation exceeds the lookup threshold, the receiving server returns a PermError result. Organizations using multiple third party email platforms should regularly audit SPF lookup depth to avoid authentication issues caused by excessive include chains and recursive DNS lookups.\u00a0","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247725547","position":3,"url":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247725547","name":"What causes SPF permerror illegal mechanism include?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"The spf permerror illegal mechanism include warning that usually appears when an include: statement references a domain with an invalid or unusable SPF configuration. This can happen if the referenced domain does not exist, publishes no SPF record, contains malformed SPF syntax, or returns an invalid response during evaluation. This issue differs from the PermError caused by exceeding the 10 DNS lookup limit. In this case, the receiving mail server cannot properly interpret or evaluate the included SPF policy. Administrators should validate all included targets before publishing SPF changes to avoid permanent SPF evaluation failures.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247749964","position":4,"url":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247749964","name":"Should I use include: or add IPs directly to my SPF record?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Using include: is typically recommended when third party services manage their own sending infrastructure and publish SPF records for customers to reference. This allows providers to update authorized IP addresses without requiring manual SPF changes on your side. Direct IP entries may be appropriate for internally managed mail servers or static sending infrastructure that rarely changes. In enterprise environments, SPF records often contain a combination of direct IP mechanisms and include: statements. Administrators should balance operational flexibility, DNS lookup usage, and long-term SPF maintainability when deciding how to structure SPF authorization policies.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247827140","position":5,"url":"https:\/\/easydmarc.com\/blog\/spf-include-mechanism\/#faq-question-1782247827140","name":"How do I fix an SPF record that exceeds the 10 DNS lookup limit?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Start by auditing your current SPF record to count all DNS-resolving mechanisms, including nested includes inside referenced third-party SPF records. Remove any include: statements for sending services your organization no longer uses. Where possible, consolidate multiple include: references from the same provider into a single authorized entry. For remaining services, check whether the provider offers a flattened or optimized SPF record that resolves fewer lookups. If lookup depth remains a concern after cleanup, SPF flattening tools can reduce recursive evaluation by substituting include chains with resolved IP ranges, though this requires ongoing maintenance as provider infrastructure changes. EasyDMARC's SPF checker surfaces lookup depth and chain structure so administrators can identify which include: references are contributing most to the total count.","inLanguage":"en-US"},"inLanguage":"en-US"}]}},"jetpack_featured_media_url":"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2026\/06\/SPF-Hero-1.png","_links":{"self":[{"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/posts\/62654","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/users\/58"}],"replies":[{"embeddable":true,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/comments?post=62654"}],"version-history":[{"count":1,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/posts\/62654\/revisions"}],"predecessor-version":[{"id":62658,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/posts\/62654\/revisions\/62658"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/media\/62657"}],"wp:attachment":[{"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/media?parent=62654"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/categories?post=62654"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/tags?post=62654"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}