SPF too many DNS lookups: fix the 10 lookup limit

Your SPF record can be valid on paper and still fail SPF checks. The usual cause is too many DNS lookups: SPF allows 10. Each new email service you add brings another include:, and past the limit receivers return permerror. This article explains what counts toward the limit, how to count your own lookups and how to get back under 10.

How the SPF 10 DNS lookup limit works

When a mail server checks SPF, it reads your TXT record and follows every term that needs another DNS query. RFC 7208, section 4.6.4 caps those terms at 10 per evaluation. Above that, the receiver must return permerror, which means "this SPF record is broken".

The count includes nested lookups. If your record has include:_spf.example.net and that record has three more includes, you have used four lookups, not one.

There is a second, lesser-known limit. The RFC recommends allowing only two "void lookups": terms whose query returns no records or a non-existent name. An include: pointing to a deleted provider record can push you into permerror on its own.

For the business

When SPF returns permerror, receivers treat your domain as having no working SPF. Legitimate invoices, password resets and newsletters are more likely to land in spam or be rejected, especially once DMARC is enforced. The fix is a DNS change that usually takes an hour of work and costs nothing.

How to fix too many SPF lookups

1. List what you send with. Write down every service that sends mail as your domain: mailbox provider, CRM, helpdesk, newsletter tool, billing system. Anything not on the list does not need to be in SPF.

2. Remove dead and unused terms. Delete includes for services you no longer use. Delete ptr. Remove a and mx unless your web or mail server really sends mail directly. Each removal saves at least one lookup.

3. Replace stable hosts with IP addresses. If a server you run has a fixed address, use ip4: or ip6: instead of a: or mx. These cost zero lookups.

v=spf1 ip4:192.0.2.25 include:_spf.example.net include:mail.example.org -all

1. Move a sender to a subdomain. Marketing and transactional tools can often send from a subdomain such as news.example.com. That subdomain gets its own SPF record and its own 10 lookups, and your main record gets shorter.

news.example.com.  TXT  "v=spf1 include:_spf.example.net -all"

1. Be careful with flattening. Flattening replaces includes with the provider's current IP ranges. It removes lookups, but providers change their ranges without telling you. If you flatten, use a tool or process that updates the record automatically. A stale flattened record fails quietly.

2. Keep one SPF record. Two TXT records starting with v=spf1 on the same name also produce permerror. Merge them into one. If the record grows past 255 characters, split it into several quoted strings in the same TXT record. Receivers join them without spaces.

How to check your SPF lookup count

Read your record first:

dig TXT example.com +short

Then follow each include: and redirect= by hand and count every include, a, mx, ptr, exists and redirect you find, at every level:

dig TXT _spf.example.net +short

Only run checks like these against sites you own or are allowed to test.

A manual count works for small records but is easy to get wrong with deep nesting. Our free SPF check needs no account and looks at your SPF record together with DKIM, DMARC and MX. Run it again after every change, and again whenever you add a new email service.

Check your SPF record for free