Guides › SPF

SPF 10 DNS lookup limit: how to fix 'too many lookups'

RFC 7208 caps SPF evaluation at 10 DNS-querying mechanisms. Above that, receivers return permerror and SPF fails for all your mail, often without anyone noticing.

What counts

• Count 1 each: include, a, mx, ptr, exists, redirect. This includes the ones inside included records, recursively.
• Free: ip4, ip6, all.

Fixes, safest first

1. Remove includes for services you no longer use. This is very common.
2. Move bulk or marketing senders to a subdomain (such as news.yourdomain.com) with its own SPF.
3. Drop a and mx if those hosts don't send mail.
4. Rely on DKIM for services that sign with your domain. DMARC passes on aligned DKIM alone, so some providers (Mailchimp, SendGrid with automated security) don't need a root include at all.
5. As a last resort, flatten (replace includes with ip4/ip6 ranges). Provider IPs change, so flattened records need monitoring.

The checker counts your lookups recursively and shows the full include tree.

Related