SPF 10 DNS Lookup Limit: What It Is, Why It Matters, and How to Fix It

RFC 7208 (the SPF specification) limits SPF evaluation to 10 DNS lookups. This prevents SPF from being used in DNS amplification attacks and keeps evaluation fast.

If your SPF record requires more than 10 DNS lookups, the receiving server returns a 'permerror' result — which most mail servers treat the same as a fail. This means your emails may be rejected or marked as spam even though you're a legitimate sender.

The 10-lookup limit is strict and is enforced by most modern mail servers.

Mechanisms that count: include:, a, mx, ptr, exists, redirect=

Mechanisms that do NOT count: ip4:, ip6: (these are direct IP comparisons, no DNS needed), all

Each include: directive not only counts as 1 lookup itself, but also adds the lookups from the included domain's SPF record recursively. This is how organizations exceed the limit without realizing it — including _spf.google.com might trigger 3-4 more lookups internally.

Use an SPF checker tool that recursively counts all DNS lookups in your chain. Manual counting:

1. Parse your SPF record and count each include:, a, mx, ptr, exists 2. For each include:, fetch that domain's SPF record and count its mechanisms too 3. Repeat recursively until all chains are counted 4. Total must be ≤ 10

Example: v=spf1 include:_spf.google.com include:sendgrid.net include:spf.protection.outlook.com ~all

This looks like 3 lookups, but each include expands to more, potentially totaling 8-12+

Replace include: with ip4:/ip6: where possible: If you know the specific IP ranges a service uses and they're stable, use ip4: instead of include:. No lookup required.

SPF flattening: A service that resolves all your include: chains and converts them to flat ip4: entries. Risk: if a provider changes their IPs, your SPF breaks until you reflatten.

Remove services you no longer use: Audit your SPF record and remove includes for services you've stopped using.

Consolidate sending: Use fewer sending services, each with fewer lookups.

Sub-selector SPF: Route different email types (transactional vs marketing) through different subdomains with separate SPF records — each with fewer lookups.

# OVER THE LIMIT — 12+ lookups (will cause permerror)
v=spf1 include:_spf.google.com include:sendgrid.net
        include:spf.protection.outlook.com
        include:servers.mcsv.net include:_spf.salesforce.com
        a:mail.yourdomain.com mx ~all

# FIXED — 4 lookups (uses ip4: to eliminate include: calls)
v=spf1 include:_spf.google.com
        ip4:149.72.0.0/16 ip4:167.89.0.0/16
        ip4:40.92.0.0/15 ip4:40.107.0.0/16
        ip4:104.47.0.0/17
        ip4:198.2.128.0/18
        ~all

# Notes:
# _spf.google.com = 1 lookup (Google Workspace)
# ip4: ranges replace SendGrid, Outlook, Mailchimp, Salesforce includes
# Each ip4: costs 0 lookups
# Total: 1 lookup (well under the 10 limit)