The latest articles on DEV Community by Hanzala Rasool (@hanzala_rasool_6d069eeab1). https://dev.to/hanzala_rasool_6d069eeab1 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4242226%2F1cafd729-1bd4-4572-8261-f0db81783762.jpg https://dev.to/hanzala_rasool_6d069eeab1 en Hanzala Rasool Fri, 13 Nov 2026 05:43:13 +0000 https://dev.to/hanzala_rasool_6d069eeab1/how-to-fix-spf-permerror-too-many-dns-lookups-1f0a https://dev.to/hanzala_rasool_6d069eeab1/how-to-fix-spf-permerror-too-many-dns-lookups-1f0a <p>SPF has a hard limit: checking your record may take no more than <strong>10 DNS lookups</strong>. Go over it and the result is <code>permerror</code>, which many receivers treat as a failed SPF check, so your mail is more likely to land in spam. It usually creeps up on you as you add more services that send email for you.</p> <h2> What counts towards the 10 </h2> <ul> <li> <strong>Counts:</strong> <code>include:</code>, <code>a</code>, <code>mx</code>, <code>ptr</code>, <code>exists:</code> and <code>redirect=</code> </li> <li> <strong>Doesn't count:</strong> <code>ip4:</code>, <code>ip6:</code> and <code>all</code> </li> <li> <strong>Nested lookups count too.</strong> <code>include:_spf.google.com</code> is one lookup, but Google's record includes others, and those count against your 10 as well.</li> </ul> <h2> Find what's using your lookups </h2> <p>Look at your current record:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>nslookup -type=txt yourdomain.com </code></pre> </div> <p>Count every <code>include</code>, <code>a</code>, <code>mx</code>, <code>ptr</code> and <code>exists</code>, then repeat for each included domain. Or paste your domain into a checker that does it for you, like this <a href="https://imageconvert.art/tools/spf-dmarc-check" rel="noopener noreferrer">free SPF &amp; DMARC check</a>. If the top level is already close to 10, the includes inside it almost certainly push you over.</p> <h2> Five ways to get under the limit </h2> <ol> <li> <strong>Remove services you no longer use.</strong> Old newsletter tools and CRMs are the usual culprits.</li> <li> <strong>Replace <code>a</code> and <code>mx</code> with <code>ip4:</code></strong> if your own servers have fixed IP addresses. IP addresses don't use lookups.</li> <li> <strong>Remove <code>ptr</code>.</strong> It's deprecated and slow anyway.</li> <li> <strong>Send marketing mail from a subdomain</strong>, such as <code>news.yourdomain.com</code>, with its own SPF record. Each domain gets its own 10 lookups.</li> <li> <strong>Flatten carefully.</strong> Replacing an include with the IP addresses it contains saves lookups, but if the provider changes its IPs your SPF silently breaks. Only flatten with a tool that keeps it updated.</li> </ol> <h2> Don't forget DKIM </h2> <p>DMARC passes if <em>either</em> SPF or DKIM passes and aligns with your domain. Setting up DKIM for every service that sends as you makes SPF less critical, and some services can't be added to SPF at all without going over the limit.</p> <p>Quick end-to-end test: send yourself an email in Gmail, open it, choose <strong>Show original</strong>, and look for <code>PASS</code> next to SPF, DKIM and DMARC.</p> <p><em>Originally published at <a href="https://imageconvert.art/guides/spf-too-many-dns-lookups" rel="noopener noreferrer">imageconvert.art</a>, where there's also a <a href="https://imageconvert.art/guides/spf-dkim-dmarc-setup" rel="noopener noreferrer">full SPF, DKIM and DMARC setup guide</a>.</em></p> email dns devops webdev