Guide
Fix SPF “too many DNS lookups”
SPF is capped at 10 DNS lookups. Go over and your record fails with a PermError — here's why, and five ways to fix it.
Check your SPF record →What the error means
To stop SPF being used to overload DNS, the spec limits evaluation to 10 DNS lookups. When a receiver has to resolve more than 10 to check your record, it stops and returns a PermError — and treats your SPF as if it doesn't exist. Mail still sends, but SPF no longer passes, which undermines DMARC alignment and hurts deliverability.
What counts as a lookup
Each of these mechanisms triggers a DNS lookup: include, a, mx, ptr, exists and redirect. A single include to a big provider can itself contain several nested lookups — which is how records quietly creep over the limit. ip4 and ip6 do not count.
Five ways to fix it
Old ESPs, trial tools and former CRMs often linger in your SPF. Every include you delete frees up lookups — start here.
If a provider publishes fixed sending IPs, list them directly with ip4:/ip6: instead of include:. Direct IPs don't count as lookups (but you must maintain them if the provider changes).
Send bulk/marketing mail from a subdomain (e.g. mail.yourdomain.com) with its own SPF. That moves those includes off your root domain's record.
Fewer sending services means fewer includes. Route mail through one platform where you can.
A flattening service expands all your includes into raw IPs in one record. It fixes the limit, but you must keep it updated when providers change IPs, or mail will start failing SPF.
New to SPF entirely? Read the full SPF guide for how the record is structured and every option explained.
See your SPF lookup count
Our free checker shows whether your SPF is valid and passing — and monitoring alerts you if a provider change ever pushes you over the limit.