SPF 10 DNS Lookup Limit
Why SPF has a 10 lookup limit, how it breaks your email, and proven strategies to fix PermError without losing mail delivery.
The Problem: Too Many DNS Lookups
When your SPF record exceeds 10 DNS lookups, mail servers return a PermError (permanent error). This can cause legitimate emails to be rejected or marked as spam.
The SPF specification (RFC 7208) limits SPF records to a maximum of 10 DNS lookups to prevent abuse and reduce DNS load. This limit is strictly enforced by all major email providers including Gmail, Outlook, and Yahoo.
What Breaks
- ✗SPF returns PermError instead of Pass
- ✗DMARC alignment fails (SPF not passing)
- ✗Emails go to spam or get rejected
- ✗Deliverability drops significantly
Why It Happens
- •Each
include:counts as 1 lookup - •Included SPF records also lookup recursively
- •Using multiple ESPs (Google, Microsoft, SendGrid...)
- •MX and A mechanisms trigger additional lookups
How to Count DNS Lookups
Understanding which SPF mechanisms trigger DNS lookups is critical to staying under the 10 lookup limit.
Mechanisms That Count as Lookups
include:_spf.google.cominclude: Each include= counts as 1 lookup, PLUS any lookups in the included record
a:mail.example.coma: Looks up A record (and AAAA if present) = 1 lookup
mxmx: Looks up MX record = 1 lookup (+ additional lookups for each MX host)
ptrptr: Reverse DNS lookup = 1 lookup (DEPRECATED - avoid using)
exists:%{i}.spf.example.comexists: Checks if a DNS record exists = 1 lookup
Mechanisms That DON'T Count
ip4:192.0.2.0/24ip4: Static IPv4 address - NO lookup required
ip6:2001:db8::/32ip6: Static IPv6 address - NO lookup required
~allall: Match-all qualifier - NO lookup required
Example: Counting a Real SPF Record
Let's count the DNS lookups in this common SPF record:
v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:sendgrid.net include:_spf.salesforce.com mx a -allLookup Count Breakdown:
include:_spf.google.com1 lookup + 2 nested includes (gmail.com, googlemail.com)
include:spf.protection.outlook.com1 lookup + 1 nested include
include:sendgrid.net1 lookup (no nested includes)
include:_spf.salesforce.com1 lookup + 2 nested includes
mxMX record lookup for yourdomain.com
aA record lookup for yourdomain.com
❌ OVER THE LIMIT! This SPF record will return PermError
This SPF record exceeds 10 lookups and will fail SPF checks. You must reduce the lookup count to 10 or below.
5 Strategies to Reduce DNS Lookups
Replace include: with ip4:/ip6:
The most effective solution: replace include: statements with direct IP addresses (if IPs are static).
include:_spf.google.comip4:209.85.220.0/19 ip4:64.233.160.0/19 ip4:66.102.0.0/20💡 Savings: 3 lookups (but requires manual IP updates when Google changes IPs)
Trade-off: You must manually update IPs when your ESP changes them. Only use for static IPs.
Remove Unnecessary Mechanisms
Audit your SPF record and remove mechanisms you no longer use.
Typical Savings: 1-3 lookups by removing unused mechanisms
Use SPF Macros for Subdomains
Move third-party senders to subdomains with separate SPF records.
v=spf1 include:_spf.google.com -allOnly 3 lookups for primary email
marketing.example.com → v=spf1 include:sendgrid.net -all1 lookup for SendGrid marketing emails
crm.example.com → v=spf1 include:_spf.salesforce.com -all3 lookups for Salesforce emails
Result: Main domain stays under 10 lookups. Each subdomain has its own limit.
SPF Flattening (Advanced)
Replace include: statements with the IP addresses they resolve to.
SPF flattening services automatically monitor included SPF records and update your record with the resolved IP addresses.
- • Reduces lookups to near zero
- • Automated IP updates
- • Maintains ESP compatibility
- • Requires paid service
- • Very long SPF records
- • May hit 255-character limit
Consolidate Email Providers
Reduce the number of email service providers you use.
If you're using 5+ different email services (Google Workspace, Microsoft 365, SendGrid, Mailchimp, Salesforce, etc.), consider consolidating:
- Use one ESP for all marketing/transactional email
- Configure third-party apps to send via your main ESP (SMTP relay)
- Migrate legacy systems to modern providers with fewer lookups
Testing Your Optimized SPF Record
After making changes, verify your SPF record is under 10 lookups and still authorizes all legitimate senders.