Guide

Fixing "SPF PermError: too many DNS lookups"

Why SPF stops at 10 DNS lookups, how the count is worked out across nested includes, and four ways to bring a record back under the limit.

SPF caps the number of DNS queries a receiver will make while evaluating your record at 10 (RFC 7208 §4.6.4). Go over and the result is permerror: SPF fails for every message, legitimate or not, and DMARC has to rely on DKIM alone.

What counts

These terms each cost one lookup: include, a, mx, ptr, exists, and the redirect modifier. ip4, ip6 and all are free.

The count is for the whole tree. include:_spf.google.com costs one lookup itself, and the record it points at contains further includes that are counted too. A record that looks like it has four terms can easily cost twelve.

There is a second limit people meet less often: no more than 2 void lookups, meaning queries that return nothing. An include for a service you cancelled, whose SPF record is gone, counts against it.

How to get back under the limit

  1. Remove what you no longer use. Old marketing tools and abandoned trials are the usual culprits. This is the only fix with no downside.
  2. Replace a and mx with addresses. If your web server sends mail from a fixed IP, ip4:203.0.113.10 does the same job as a for free.
  3. Move senders to a subdomain. Marketing mail sent from news.example.com is checked against that subdomain's own SPF record, with its own budget of 10. Most bulk-mail tools support a custom sending domain.
  4. Flatten, carefully. Replacing an include with the IP ranges it resolves to removes lookups, but the provider can change those ranges at any time without telling you. Only flatten with a tool that keeps the record updated automatically.

Checking the count

The SPF checker walks every include and redirect, counts the lookups and void lookups across the tree, and shows how much each include costs, so you can see which ones to cut.

Count your SPF lookups

More guides

  • SPF, DKIM and DMARC explained How the three email authentication standards fit together, what each one proves, and which you need to stop people sending email as your domain.
  • How to create an SPF record Build a correct SPF record step by step: find every service that sends as you, add the right includes, pick between -all and ~all, and avoid the common mistakes.
  • Moving DMARC from p=none to p=reject A safe rollout plan for DMARC: start monitoring, read the aggregate reports, fix legitimate senders, and step up to quarantine and reject without losing mail.
  • What DKIM is and how to set it up How DKIM signatures work, where the public key lives in DNS, what a selector is, and how to turn DKIM on for the services that send your mail.
  • How to secure a domain that sends no email Parked and website-only domains are easy targets for spoofing. Three DNS records — null MX, a deny-all SPF record and DMARC reject — lock them down.
  • DMARCbis: what changed in DMARC in 2026 (RFC 9989) DMARC was revised in May 2026 as RFC 9989, 9990 and 9991. What is new, what was removed — pct, rf and ri — and what to change in your record.
  • DKIM2: the next version of DKIM, explained DKIM2 is an IETF draft that chains signatures across every hop, records how intermediaries change a message, and stops DKIM replay. What it does and where it stands.
  • How to set up MTA-STS and TLS-RPT Stop attackers stripping TLS from email sent to your domain. Publish an MTA-STS policy in testing mode, collect TLS-RPT reports, then enforce.