How to fix "SPF too many DNS lookups"

If a checker reports PermError: too many DNS lookups, receivers are treating your SPF as broken, which can push mail to spam or fail DMARC. Here's why it happens and how to fix it.

Why the limit exists

SPF (RFC 7208) caps evaluation at 10 DNS-querying terms, so a single email can't trigger unbounded DNS traffic. When a receiver hits the eleventh lookup, it stops and returns permerror. Many receivers then treat SPF as failed.

What counts toward the 10

• Count: include:, a, mx, exists:, redirect= and the deprecated ptr, plus everything inside each include. One include: of a big provider can cost 3–4 lookups on its own.
• Don't count: ip4:, ip6: and all.

That's why a record with only six includes can still go over: the nested ones add up.

Five ways to get back under 10

1. Remove senders you no longer use

Old newsletter tools, a CRM you cancelled, a help desk you replaced: each still costs lookups. Remove any include for a service that no longer sends as your domain. This is the safest fix and often the only one you need.

2. Drop a, mx and ptr if they aren't needed

mx only matters if your inbound mail servers also send mail, which is rare with Google Workspace or Microsoft 365. a only matters if your website server sends mail. ptr is deprecated, so remove it.

3. Move marketing or bulk mail to a subdomain

Send newsletters from news.yourdomain.com and give that subdomain its own SPF record. Each domain gets its own 10 lookups, and it keeps your main domain's reputation separate.

4. Use the provider's return-path instead of an include

Many email platforms send with their own bounce (Return-Path) domain and authenticate with DKIM. For DMARC, those senders don't need to be in your SPF at all. Check your provider's docs: some explicitly say the SPF include is optional.

5. Flatten carefully (last resort)

"Flattening" replaces includes with the IP ranges they resolve to. It works, but providers change their IPs without notice, and a stale flattened record silently breaks delivery. Only flatten with a tool that re-checks and updates the record automatically.

After you change it

1. Keep exactly one SPF TXT record at the root of the domain.
2. Recheck the lookup count with the checker or build a clean record with the SPF generator, which counts lookups live.
3. Watch your DMARC reports for a few days to confirm every legitimate sender still passes.