How do I fix 'SPF: too many DNS lookups'?

RFC 7208 allows at most 10 DNS-lookup mechanisms while an SPF record is evaluated. The mechanisms include, a, mx, ptr, exists and the redirect modifier each count, including those nested inside other includes. Going over gives a permanent error (permerror), so SPF fails. Fix it by removing unused includes and replacing lookups with ip4 or ip6 ranges.

Why it matters

When SPF returns a permanent error, receivers cannot rely on it, and your mail may lose the SPF signal that DMARC needs. The problem often appears gradually: each new service adds an include:, and each of those includes may add several more lookups of its own. The record looks short but the total can quietly pass 10.

How to do it

Mechanisms that cost a lookup: include, a, mx, ptr, exists and redirect. Mechanisms that cost none: ip4, ip6 and all. RFC 7208 also advises limiting "void" lookups, those that return nothing, to two.

Run your domain through an SPF checker that counts lookups, or follow each include: by hand with dig TXT _spf.mailprovider.example +short and add up the nested mechanisms. Write down the total and which services contribute most.
Remove includes for services you no longer use. Old newsletter tools are common culprits.
Check whether each service needs to be in your SPF record at all. Some send with their own bounce domain, so your SPF is not involved, and DKIM covers them.
Replace a lookup-heavy include with fixed addresses only if the provider publishes stable ranges:

v=spf1 ip4:203.0.113.0/24 include:_spf.mailprovider.example ~all

Be careful. Providers can change their addresses, and a hard-coded list then goes stale and starts failing real mail. Recheck it on a schedule. 5. Move some senders to a subdomain, for example news.example.com, which has its own SPF record and its own count of 10. 6. Avoid ptr. RFC 7208 discourages it because it is slow and unreliable. 7. Republish the shortened record, wait for DNS to update, and recount.

Common mistakes

Counting only the include: entries you can see and ignoring the ones nested inside them.
Flattening everything into IP addresses once and never updating it.
Replacing the mechanism with +all to make errors disappear, which allows anyone to send as you.
Splitting the record into two TXT records. Two SPF records are also an error.
Leaving mx and a in a record when the sending servers are already covered by another entry.

Frequently asked questions

Does ip4 count toward the limit?

No. ip4, ip6 and all do not trigger DNS lookups, so they are the cheapest way to authorise a sender.

What happens when SPF hits the limit?

Evaluation stops with a permerror. Receivers treat that as a failure of the SPF check, though they may still look at DKIM.

Is there a limit on record length too?

A single DNS string is limited to 255 characters, and long SPF records are split into several strings in one TXT record. A very long record is also a sign that it needs a cleanup.

Want to check your domain? Try the free website sample.