Teaser only. This is not the full article. Complete guide with lookup counting and M365 templates: Fix SPF Permerror (Too Many Lookups)
Your TXT record looks fine in Cloudflare. Gmail returns permerror anyway.
Most teams count visible include: statements. Receivers walk nested SPF records until RFC 7208's ten lookup cap breaks evaluation entirely. Add M365, Mailchimp, and a legacy vendor path and you can cross the limit without changing the line you stare at in DNS.
Quick check:
dig example.com TXT +short | grep spf
If expansion crosses ten lookups, SPF does not pass or fail cleanly. It permerrors. DMARC alignment on the SPF leg collapses with it.
In the full post on zerohook.org:
- How to count nested lookups (not just top-level includes)
- Copy-paste M365 + ESP templates under the cap
- When to split marketing to a subdomain
- DMARC and deliverability impact when SPF breaks
Read the full guide: Fix SPF Permerror (Too Many Lookups)
Top comments (0)