Fix “SPF too many DNS lookups”

Why the limit exists

Every include:, a, mx, exists and redirect in your SPF record makes the receiving server look up another DNS record, and many includes contain more includes. To stop slow or abusive records, the SPF standard caps the total at 10. Past that, the check fails with a “permerror” and your SPF counts for nothing.

1. See what’s using your lookups

Run the SPF checker. It lists every service in your record with the number of lookups each one costs, including the services they pull in. Usually one or two services account for most of the total.

2. Remove services you no longer use

The quickest win. Old newsletter tools, a previous email provider, a help desk you’ve cancelled: if it no longer sends email on your behalf, take its include: out. Check with colleagues first; finance and marketing often sign up for tools that send email.

3. Drop a, mx and ptr if they’re not needed

If all your email goes through a provider such as Microsoft 365 or Google Workspace, you probably don’t need a or mx in your record. ptr is outdated and should always be removed.

4. Send bulk email from a subdomain

Marketing platforms are often the heaviest includes. Many let you send from a subdomain such as news.yourdomain.com, which has its own SPF record and its own 10 lookups. Your main domain’s record then only needs your mailbox provider.

5. Replace an include with IP addresses (with care)

If a service publishes a small, stable list of sending addresses, you can list them as ip4: entries, which cost no lookups. Only do this when the provider says their addresses are fixed. If they change, your SPF silently breaks. Automated “SPF flattening” services keep the list up to date for you.

Check your work

Use the SPF record builder to put the new record together. It counts lookups live. Then publish it in place of the old one (never alongside it) and run the SPF checker again.