Every lookup-costing term spends one, except two that spend more. mx is the one you will actually meet, and it is routinely counted as 1 when it is not.
What mx does
mx matches if the connecting address is one of the addresses of one of the domain’s MX hosts. That requires resolving the MX set, and then resolving each host it names.
mx
├─ resolve the MX RRset 1 lookup
├─ resolve mail1.example.com A/AAAA 1 lookup
├─ resolve mail2.example.com A/AAAA 1 lookup
└─ resolve mail3.example.com A/AAAA 1 lookup
---------
4 lookupsRFC 7208 §4.6.4 caps the per-term host resolutions at 10 — but that cap is a ceiling on one term, not a discount. A domain with five MX hosts spends six on a single mx.
A real one
v=spf1 a mx ip4:149.20.0.0/20 ip6:2001:04F8::0/32 ... include:shops.shopify.com include:servers.mcsv.net include:_spf.salesforce.com ... -all
5 mx.pao1.isc.org. 10 mx.ams1.isc.org.
a— 1mx— 1 for the set, plus 1 for each of the two hosts = 3- Three includes — 3, plus whatever each spends internally
So this record is at 7 before a single included record is opened, and mx accounts for three of them. Counted as 1, you would have said 5 and been comfortably wrong.
The cost is not yours to control
Adding a fourth MX host for redundancy — a sensible, unrelated operational decision, very possibly made by someone else — silently adds a lookup to your SPF budget. Nothing warns you, and the SPF record was not edited.
a is cheaper but not free
a resolves one name and costs 1, whether it returns one address or twenty. It is much safer than mx for that reason.
What to do about it
mx is usually there because someone assumed the servers that receive mail are the servers that send it. That was true in 2005 and is frequently false now — inbound is a filtering service, outbound is a platform, and the MX hosts may send nothing at all.
- Check whether your MX hosts actually send. If they do not,
mxis authorising hosts for no reason and can simply be removed. - If they do, name them. Replacing
mxwith the literalip4ranges of the hosts that genuinely send costs zero lookups — and it stops an inbound-side change from moving your SPF budget. - Removing
mxis often the cheapest headroom available, and unlike flattening an include it does not create anything that needs monitoring.