Ten lookups.
Eleven breaks everything.
SPF has a hard ceiling of ten DNS lookups per evaluation. Cross it and receivers return permerror — which does not mean "partly working". It means your SPF record no longer authenticates anything, including the mail it used to pass.
What counts toward the ten
The limit is on DNS-querying mechanisms, not on the length of the record. These count:
| Mechanism | Counts | Note |
|---|---|---|
include: | 1 each | Plus everything inside it, recursively |
a, mx | 1 each | mx also caps at 10 MX records |
ptr | 1 | Deprecated — remove it |
exists:, redirect= | 1 each | |
ip4:, ip6:, all | 0 | No DNS query — free |
Recursion is what actually gets you
An include: is not one lookup — it is one plus whatever that record contains. A
single large provider's include can carry four or five of its own. Three such providers and you are at
the ceiling with a record that looks short and innocent.
Worse: those are their records. A provider adding an include on their side can push you over the limit without you changing anything, and nobody tells you.
Counting yours
Start with the record itself:
dig +short TXT example.com | grep spf1Then expand each include: and count recursively. Doing it by hand is tedious and error-prone;
any SPF validator will do it for you and print the total. What matters is the number and which include is
responsible for most of it.
To confirm a real failure rather than a theoretical one, read the headers of a delivered message. A
receiver reporting spf=permerror is the ground truth, and it is the same
Show original view in Gmail we use for
checking alignment.
Getting back under ten
- Remove senders you no longer useThe most common win by far. Records accumulate includes for tools that were trialled once. Every one is a lookup and a spoofing surface.
- Replace an include with its IPs
ip4:andip6:cost zero lookups. Only do this where the provider publishes stable addresses — if they renumber, your mail fails and you will not be told. - Use subdomains per senderSend marketing from
news.example.comwith its own SPF record and its own ten-lookup budget. This is the properly scalable answer, and it separates reputation too. - Delete
ptrDeprecated, slow, and a free lookup back. - Lean on DKIM insteadDMARC passes if either SPF or DKIM aligns. DKIM has no lookup limit and survives forwarding. If you are fighting the SPF ceiling, the strategic fix is to stop depending on SPF for alignment.
A word on SPF flatteners
Services exist that "flatten" your record — resolving every include to raw IPs and hosting the result, usually behind a paid subscription that re-flattens when providers renumber.
They work. They also make a provider's IP changes your outage risk, and add a dependency to the path that decides whether your mail is delivered. Before subscribing, try removing unused senders and moving one high- volume sender to its own subdomain — that resolves most records we look at, permanently and for free.
The durable position
SPF under ten lookups, DKIM signing on your own domain for every sender, and DMARC alignment achieved through DKIM rather than SPF. Then the lookup ceiling stops being something you manage and becomes something you simply stay under.
Send us your domain and we will count them
We will expand every include, tell you your true lookup count, which sender is responsible, and whether you are already returning permerror. Free, and it takes ten minutes.
Book a call →