One of the most common SPF problems is exceeding the 10 DNS lookup limit. When this happens, SPF returns a permanent error (PermError), and your emails may fail authentication.
What Is the 10 Lookup Limit?
The SPF specification (RFC 7208) limits SPF evaluation to 10 DNS lookups. This prevents infinite loops and excessive DNS traffic.
What Counts as a Lookup
| Mechanism | Lookups |
|---|---|
include: |
1 + lookups in included record |
a |
1 |
mx |
1 |
ptr |
1 (deprecated, avoid) |
exists: |
1 |
redirect= |
lookups in target record |
What Does NOT Count
-
ip4:- direct IP, no lookup needed -
ip6:- direct IP, no lookup needed -
all- no lookup needed
Counting Your Lookups
Example record:
v=spf1 include:_spf.google.com include:servers.mcsv.net include:sendgrid.net mx -all
Lookup count:
-
include:_spf.google.com= 1 + ~3 nested = ~4 -
include:servers.mcsv.net= 1 + ~2 nested = ~3 -
include:sendgrid.net= 1 + ~1 nested = ~2 -
mx= 1 - Total: ~10 (at the limit!)
Solutions for Too Many Lookups
1. Remove Unused Services
Audit your SPF record. If a service no longer sends email for you, remove its include.
2. Replace Mechanisms with IP Addresses
Instead of:
mx
Use:
ip4:192.168.1.1 (your mail server IP)
3. SPF Flattening
Replace includes with the actual IP addresses they resolve to.
Before: include:_spf.google.com
After: ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ...
Important: Flattened IPs can change. Use a service that auto-updates, or manually verify periodically.
4. Use Subdomains
Different services can send from different subdomains:
- Marketing: mail.yourdomain.com
- Transactional: notify.yourdomain.com
- Support: help.yourdomain.com
Each subdomain gets its own SPF record with its own 10-lookup budget.
5. Combine Similar Services
Some services share infrastructure. Check if one include covers multiple services you use.
Using Flattening Services
Several services automate SPF flattening:
- Auto-resolve includes to IPs
- Dynamically update when provider IPs change
- Keep you under the lookup limit
These typically work by having you point to their record, which they keep optimized.
Checking Your Lookup Count
Use free tools:
- MxToolbox SPF Lookup (shows total lookups)
- dmarcian SPF Surveyor (visual lookup tree)
- Kitterman SPF Query Tool
What Happens at Exactly 10?
10 lookups is the limit—not 11. At exactly 10, you're safe but have no room to grow. Best practice is to stay under 8-9 to leave room for additions.
What Happens Over 10?
The receiving server stops evaluating and returns PermError. This typically means:
- SPF cannot be evaluated
- DMARC may fail (depending on DKIM)
- Emails may be marked as suspicious
Prevention Strategy
- Count lookups before adding new services
- Review record quarterly and remove unused includes
- Use IP addresses instead of a/mx mechanisms
- Plan for growth—don't use all 10 initially
- Consider subdomains for different email types
For complete SPF guidance, see our SPF creation guide.
0 comments