If a DMARC report or a checker says spf=permerror or "SPF exceeded 10 DNS lookups", your SPF record is being ignored by receivers, even though it looks fine when you read it. Here is what is actually counted and how to get back under the limit.
What the limit is
RFC 7208 allows at most 10 DNS-querying terms while evaluating one SPF record. These count: include, a, mx, ptr, exists and redirect. These do not: ip4, ip6 and all. The count is recursive, so each include: also adds whatever lookups sit inside the record it points to.
That is how a short record blows the budget. include:_spf.google.com is one lookup that expands to several more. Add a marketing platform, a helpdesk, a CRM, and Microsoft 365, and you are over 10 without trying.
There is a second, quieter limit: more than 2 "void" lookups (names that return nothing) also produces a permerror.
1. Count it properly
Do not count the include: entries by eye. Resolve each one and count the terms inside it. Write the tree out on paper: top-level record, then each include, then each include inside those.
2. Remove what you no longer use
In almost every audit the fastest win is dead weight: the tool you cancelled in 2022, the old hosting provider, a duplicate include. Each one removed frees one or more lookups. Check against your real senders, not against what the record says.
3. Replace lookups with fixed addresses where the provider's IPs are stable
An a: or mx: term costs a lookup. If your own server's IP never changes, ip4:203.0.113.5 costs none. Only do this for addresses you control. Never hard-code a big provider's ranges, because they change and you will silently break your own mail.
4. Split by sending subdomain
Give each sender its own subdomain (for example news.example.com for the newsletter platform) with its own SPF record and its own 10-lookup budget. Your main domain's record then stays small, and a problem with one tool cannot take down the others. DKIM and DMARC alignment need to be set up for each subdomain, so plan that at the same time.
5. Flattening, with care
Flattening replaces includes with the IPs they resolve to. It fixes the count, but provider ranges change, so a static flattened record goes stale and starts rejecting real mail. If you flatten, it has to be kept up to date automatically, and you need a way to notice when it drifts.
6. Verify
After the change, re-resolve the whole tree and confirm you are at 10 or under, with no more than 2 void lookups. Then send a test to a Gmail and an Outlook address and check Authentication-Results for spf=pass.
The part most people skip
The record is only correct today. Every new SaaS tool someone adds to the stack can quietly push you back over the limit, and you find out when mail starts failing. I now treat the lookup count as something to watch continuously, the same way you would watch certificate expiry, rather than something to fix once.
If you want a quick look at where your own domain stands, Email Fix Pack has a free checker that reads your live SPF, DKIM and DMARC (disclosure: I made it).
Top comments (0)