Fix guide

How to fix SPF "too many DNS lookups"

Your SPF record goes over the 10-lookup limit, so SPF fails for all your mail. Here is how to get it back under.

What the error means

SPF has a hard limit of 10 DNS lookups. Every include:, a, mx, exists and redirect= costs one, and so does every include hidden inside those includes. The SPF record syntax guide lists every part. Go over 10 and inboxes stop checking and return a “permerror”. SPF then fails for all your mail, including mail from services you listed.

You will see it as “too many DNS lookups”, “SPF PermError” or “exceeds the 10 DNS lookup limit” in a checker or in an email’s headers.

How to fix it

1

See what uses your lookups. Run your domain through the SPF checker. It shows each part of your record and how many lookups it costs, including the hidden ones.

2

Remove services you no longer use. Old newsletter tools, a helpdesk you left, a CRM trial. Each one you delete frees at least one lookup.

3

Drop a and mx if those servers don’t send. If your email goes through Google Workspace or Microsoft 365, your website and inbox servers usually don’t send mail themselves. Removing both saves two lookups.

4

Remove ptr. It is outdated, slow and officially discouraged.

5

Move bulk senders to a subdomain. Newsletters can send from news.yourdomain.com with their own SPF record, which has its own 10 lookups.

6

Still over? Flatten. Flattening swaps includes for the IP addresses behind them, which cost nothing. Do it with a service that updates automatically, because providers change their addresses without telling you.

A before and after

Before, 12 lookups:

v=spf1 a mx include:_spf.google.com include:sendgrid.net include:mailgun.org include:servers.mcsv.net include:mail.zendesk.com ~all

After removing a, mx and an unused Mailgun account (which alone used 5), 5 lookups:

v=spf1 include:_spf.google.com include:sendgrid.net include:servers.mcsv.net include:mail.zendesk.com ~all

Check it worked

Publish the new record, wait a few minutes, then count the lookups again.

Sponsored

EasyDMARC

Need every service you have? EasyDMARC flattens SPF for you and keeps it under the limit automatically.

Visit EasyDMARC