SPF "Too Many DNS Lookups" (PermError): How to Fix the 10-Lookup Limit | InboxVerify
Guide

Fix SPF "too many DNS lookups"

Why SPF has a 10 DNS lookup limit, how to count lookups, and five safe ways to get back under the limit without breaking email.

Updated October 12, 2026 · 6 min read · By the InboxVerify team

SPF limits evaluation to 10 DNS lookups. When your record needs more, receivers return PermError and SPF fails for every message — even from your legitimate servers. It happens easily, because each include: can contain more includes.

What counts as a lookup

  • include:, a, mx, ptr, exists: and redirect= each cost one lookup — plus everything inside the included records
  • ip4:, ip6: and all cost nothing
  • There is also a limit of 2 "void" lookups (names that return nothing)

The SPF Checker counts every lookup and shows the full include tree.

Five ways to fix it

  1. Remove services you no longer use. Old newsletter tools and CRMs often stay in SPF for years.
  2. Remove a, mx and ptr if those servers do not send mail (and never use ptr).
  3. Move bulk senders to a subdomain. Send newsletters from news.yourdomain.com with its own SPF record.
  4. Use the service's custom return-path. Many platforms handle SPF on their own bounce domain, so you do not need their include on your root domain at all.
  5. Replace includes with ip4/ip6 ranges — only for services with stable, published IPs, and review regularly.
Avoid "SPF flattening" services that rewrite your record automatically unless they keep it updated: if a provider changes its IPs, a flattened record silently breaks.

Frequently asked questions

Is it OK to have exactly 10 lookups?

Yes, 10 is allowed; 11 is a PermError. Leave some headroom for providers that add includes later.

Can I split SPF into two records?

No — two SPF records is itself an error. Use subdomains instead.

Does DKIM help if SPF is broken?

Yes: DMARC passes if DKIM passes and aligns, but fix SPF anyway — some receivers check it on its own.