Guides · Updated 2026-10-11

SPF "too many DNS lookups": how to fix the 10-lookup limit

SPF limits the number of mechanisms that trigger DNS queries (include, a, mx, ptr, exists and the redirect modifier) to 10, counted across every nested include. Exceed it and receivers return PermError, which DMARC treats as an SPF fail.

How to count

Each include: costs 1 plus whatever is inside it. For example include:_spf.google.com currently expands to further includes. ip4:, ip6: and all cost nothing. Our free checker counts lookups for you.

Fixes, safest first

1. Remove services you no longer use. Old CRMs and helpdesks are common culprits.
2. Drop ptr. It is slow and RFC 7208 says it should not be used. Also drop a/mx if those hosts don't send mail.
3. Move senders to subdomains. For example, send marketing from news.yourdomain.com with its own SPF record. Each subdomain gets its own 10-lookup budget.
4. Rely on DKIM for providers that sign with your domain. Many platforms use their own Return-Path, so their SPF include does nothing for DMARC alignment anyway.
5. Flatten with care. Replacing includes with IP ranges works, but providers change IPs without notice. Only flatten with automated monitoring.

Sources

• RFC 7208: SPF
• Google Workspace: Set up SPF

This guide is general information, not legal or professional advice. Provider screens change; always confirm the exact values shown in your own account.