SPF “too many DNS lookups”: what it means and how to fix it

Why the limit exists

When a mailbox checks your SPF record, it may have to look up other records the first one points to. The SPF standard caps that at ten lookups to keep checks fast and to stop SPF being used to overload DNS servers. Past ten, the result is a permanent error, which DMARC counts as a fail.

What counts toward the ten

Includes are the usual culprit. A big email provider’s include can use three or four lookups on its own, so four or five services can push you over.

• Each include: (for example include:_spf.google.com), and every lookup inside the record it includes.
• a, mx, exists, redirect, and the old ptr mechanism.
• Not counted: ip4:, ip6: and all.

How to get under it

1. Remove services you no longer useOld newsletter tools, a previous email provider, a form plugin you replaced. This alone often fixes it.
2. Remove a and mx if they’re not neededIf your website server and mail servers don’t send mail as you, these mechanisms just cost lookups.
3. Move senders to a subdomainNewsletter and marketing tools can usually send from news.yourbusiness.com with its own SPF and DKIM, taking their lookups off the main record.
4. Rely on DKIM where you canDMARC passes if either SPF or DKIM passes and lines up with your domain. A service that signs with DKIM for your domain doesn’t strictly need to be in SPF.
5. Be careful with flatteningReplacing includes with the IP addresses they resolve to gets under the limit, but providers change their addresses. Flattened records need to be kept up to date automatically, or they’ll quietly break.