SPF Too Many DNS Lookups: How to Count and Fix the 10-Lookup Limit
An SPF record that needs more than 10 DNS lookups to evaluate returns a permerror, and a receiver may then treat SPF as failed. The limit is set by RFC 7208 section 4.6.4. This page shows which terms count, how to count them across nested includes, and the usual ways to get back under the limit.
What counts toward the limit
RFC 7208 section 4.6.4 says implementations must limit the total number of DNS-querying terms to 10 during SPF evaluation, and must return permerror if the limit is exceeded. The terms that cause queries are the include, a, mx, ptr and exists mechanisms and the redirect modifier. The all, ip4 and ip6 mechanisms and the exp modifier do not cause lookups and do not count.
| Term | Counts as a lookup? |
|---|---|
| include:provider.example | Yes, and so does every counted term inside the included record |
| a, a:host | Yes |
| mx | Yes; the MX records queried are included in the overall limit, and each MX evaluation may not query more than 10 address records |
| ptr | Yes, and the RFC says this mechanism SHOULD NOT be published |
| exists | Yes |
| redirect= | Yes |
| ip4, ip6, all, exp | No |
The limit is tracked as a single global count across the whole evaluation, not per include. Section 4.6.4 also says implementations should limit void lookups, queries that return nothing, to two.
How to count your record
Fetch the record, then every record it includes, and add up the counted terms. A hypothetical example, using documentation-only domains:
example.com. TXT "v=spf1 include:_spf.mailer-a.example include:_spf.mailer-b.example mx a ~all"
_spf.mailer-a.example TXT "v=spf1 include:relay1.mailer-a.example include:relay2.mailer-a.example ~all"
_spf.mailer-b.example TXT "v=spf1 ip4:192.0.2.0/24 a:smtp.mailer-b.example ~all"Counting: two includes at the top (2), mx (3), a (4), then inside mailer-a two more includes (6), then inside mailer-b one a term (7). The two relay records may contain further terms that you add to the count. If the total passes 10, SPF returns permerror.
dig +short TXT example.com
dig +short TXT _spf.mailer-a.exampleAISend's free checker follows includes and redirects and counts lookups the way RFC 7208 section 4.6.4 describes, so its message shows how many of the 10 allowed lookups a record uses. It stops after 12 DNS queries and then reports "at least N", and it does not expand macros such as %{d}.
Ways to get back under the limit
- Remove includes for services you no longer send from. Old marketing, support and CRM tools are the usual culprits.
- Delete ptr, and replace a and mx with ip4 or ip6 terms if the addresses are stable, since ip4 and ip6 do not count.
- Replace an include with its IP ranges only if the provider publishes stable ranges. Those hard-coded addresses go stale when the provider changes them, so you take on the upkeep.
- Send different streams from different subdomains. SPF is evaluated against the domain in the MAIL FROM or HELO identity, so a service that uses its own return-path subdomain gets its own 10-lookup budget.
- Check whether SPF is even the identity you depend on. DMARC passes when SPF or DKIM passes with alignment, so a DKIM-aligned message can still pass DMARC when SPF returns permerror. That is a safety net, not a reason to leave SPF broken.
- Make sure there is only one SPF record. Two records is a separate permerror under RFC 7208 section 4.5.
After you change the record
- Run the free SPF/DMARC checker to confirm exactly one record is found.
- If the message says "at least N" lookups or your record uses macros, count the rest by hand: the checker stops after 12 DNS queries and does not expand macros.
- Send a real message and read the Authentication-Results header at the receiving mailbox.
- If you generate a new record, the free SPF record generator builds the string for you.
AISend's 3-day trial is free: 500 emails, no card, one verified domain. Paid plans are charged when you subscribe. AISend is for transactional and consented mail, and sending to anyone other than your own account email requires a verified domain.
Frequently asked questions
What is the SPF 10 DNS lookup limit?
RFC 7208 section 4.6.4 says SPF evaluation may cause at most 10 DNS-querying terms (include, a, mx, ptr, exists, redirect). Exceeding it must produce a permerror result.
Do ip4 and ip6 count toward the limit?
No. The all, ip4 and ip6 mechanisms and the exp modifier do not cause DNS queries at evaluation time and are not subject to the limit.
Do nested includes count?
Yes. The limit is tracked as one global count across the whole evaluation, so every counted term inside an included record adds to the total.
What happens if my SPF record has too many lookups?
Evaluation returns permerror. What the receiver does next is its own policy, but SPF no longer authenticates your mail, so you depend on DKIM for DMARC to pass.
Sources
More guides
Check your SPF record
The free checker finds missing and duplicate SPF records and counts DNS lookups across your includes, failing records that need more than 10.