SPF Record “Too Many DNS Lookups”: How to Fix the 10-Lookup Limit

If you’ve run an SPF check and seen the error “too many DNS lookups” or a permerror, you’re not alone. It’s one of the most common SPF misconfigurations, and it silently breaks email authentication for a lot of domains that otherwise look fine.

What the 10-lookup limit actually is

RFC 7208 caps SPF evaluation at 10 DNS lookups. Every time your SPF record references another domain, that’s a lookup. Mechanisms that count include:

• include: — the most common cause, especially when you stack multiple third-party senders
• a and mx — each triggers a lookup to resolve those records
• ptr — deprecated and expensive, avoid it entirely
• exists: — one lookup per use
• redirect= — follows to another SPF record, inheriting its lookup count

Plain ip4: and ip6: mechanisms are free — they don’t cost a lookup, which is why they’re the cheapest way to authorize senders once you know their IP ranges.

Why this breaks silently

When a receiving mail server hits the 11th lookup, it doesn’t just ignore the extra entries — the entire SPF evaluation becomes a permerror, which most receivers treat as a fail. Every legitimate sender in your record can end up unauthenticated, even ones listed near the top.

How to fix it

1. Count your current lookups

List every include:, a, mx, and nested include inside those includes — the count is recursive. A single include:_spf.google.com can itself burn 4-5 lookups once you follow its chain.

2. Flatten what you can

For services that publish stable IP ranges, replace include: with direct ip4:/ip6: entries. This removes the lookup entirely, at the cost of needing to update the record if that provider changes IPs.

3. Drop unused senders

Old marketing tools, abandoned CRMs, migrated helpdesks — SPF records accumulate cruft. Remove includes for services you no longer use.

4. Consolidate with a single subdomain strategy

If you send from many platforms, consider a dedicated sending subdomain per major platform (with its own SPF record) instead of stacking everything into one record for the root domain.

Quick sanity check

A record like this is already at 4 lookups before you’ve added your own mail server:

v=spf1 include:_spf.google.com include:sendgrid.net include:spf.mailjet.com include:amazonses.com ~all

Each of those includes can chain further. It adds up faster than people expect.