Email security · checked 16 October 2026

SPF "too many DNS lookups": how to fix it

SPF allows at most 10 DNS lookups when a receiving server checks your record. Go over and the whole check fails with a PermError, which many receivers treat like having no SPF at all. It happens quietly, usually when someone adds one more email tool.

What counts towards the 10

Counts	Doesn't count
`include:`, `a`, `mx`, `ptr`, `exists:`, `redirect=`	`ip4:`, `ip6:`, `all`

Lookups inside each include: count too. include:_spf.google.com looks like one, but Google's record contains further includes, so it uses several. That's why a record with five includes can easily need twelve lookups.

There's also a limit of 2 "void" lookups (ones that return nothing), usually caused by an include for a service you no longer use.

Four ways to get under the limit

Remove services you no longer use. Old newsletter tools, a CRM you cancelled, a previous email host. This is the safest fix and often enough on its own.
Drop a, mx and ptr unless your website server or mail server really sends email itself. ptr is discouraged by the SPF standard anyway.
Move bulk senders to a subdomain. Send newsletters from news.yourcompany.com with its own SPF record. Each domain gets its own 10 lookups.
Use ip4: ranges for services with fixed addresses. Only when the provider publishes stable IP ranges. "Flattening" big providers like Google or Microsoft into IP lists breaks the day they change their addresses, so avoid it unless a tool updates it automatically.

Other SPF mistakes that cause failures

Two SPF records on one domain. You must have exactly one; merge them into a single v=spf1 line.
No ending: finish with ~all or -all.
Typos in includes, which create void lookups.

Why it matters

A broken SPF record means your genuine email is more likely to land in spam, and if you rely on SPF for DMARC, your DMARC protection weakens too. Once SPF passes, make sure DMARC is in place: how to set up DMARC. More on how spoofing works.

Source: RFC 7208 (SPF), sections 4.6.4 (DNS lookup limits) and 5.5 (ptr). Read 16 October 2026.