OpsVantage Tools
Tools Guides opsvantage.net
Tools / Guides / SPF 10-lookup limit

SPF permerror: too many DNS lookups

Why SPF records break when they need more than 10 DNS lookups, what counts toward the limit, and five safe ways to get back under it without losing legitimate mail.

Updated 2026-11-03 · 5 min read

An SPF record can make at most 10 DNS lookups while it is being evaluated (RFC 7208). Go over and receivers stop with a permerror, which most treat as an SPF fail. Mail from every sender, including the legitimate ones, loses SPF, and DMARC then depends entirely on DKIM.

What counts toward the limit

MechanismCounts?Note
include:Yes, 1 eachPlus everything inside the included record. This is where the count explodes.
a, mxYes, 1 eachmx also looks up each MX host's address
redirect=YesPlus the target record's lookups
exists:, ptrYesptr is deprecated; remove it
ip4:, ip6:, allNoFree: no DNS lookup needed

There is a second, lesser-known limit: no more than two lookups that return nothing ("void lookups"), for example an include of a domain that no longer has an SPF record.

A typical record that breaks

v=spf1 include:spf.protection.outlook.com include:_spf.google.com include:servers.mcsv.net
 include:sendgrid.net include:mail.zendesk.com include:_spf.salesforce.com a mx ~all

Six includes plus a and mx already makes 8 at the top level, and the Google, Salesforce and Microsoft includes pull in several more lookups of their own. The total passes 10 without anyone noticing, until mail starts landing in spam.

Five ways to get under 10

  1. Remove what you no longer use. Old marketing tools, a previous mail host, a decommissioned helpdesk. The cheapest fix and usually enough.
  2. Drop a and mx unless the web server or the MX hosts really send mail. With Microsoft 365, the MX host does not send outbound mail; the Microsoft include already covers it.
  3. Replace your own servers with ip4:. If your on-premises relay has a fixed IP, list the IP instead of a hostname.
  4. Move bulk senders to a subdomain. Send marketing from news.example.com with its own SPF record and DKIM. Each subdomain gets its own 10 lookups, and a reputation problem there won't hurt your main domain.
  5. Rely on DKIM where SPF can't align anyway. Many SaaS platforms send with their own bounce domain, so including them in your SPF does nothing for DMARC. If their DKIM signs with your domain, you can often remove their include entirely. Check your DMARC reports before removing.

What about SPF flattening?

Flattening replaces includes with the IP ranges they resolve to. It works, but providers change their IPs without notice, and a stale flattened record silently fails. Only use it through a service that re-flattens automatically, and prefer the five fixes above first.

After you change the record