SPF too many DNS lookups: how to get under 10
SPF permerror "too many DNS lookups" means your record needs more than 10. Why it happens, how to count, and four ways to fix it without losing mail.
Updated 20 Oct 2026. About 2 minutes to read.
RFC 7208 lets a receiving server make at most 10 DNS lookups while it checks your SPF record. Past that, the check stops with a permanent error (permerror), and many receivers treat that as an SPF fail. Your real mail then depends on DKIM alone to pass DMARC.
What counts as a lookup
| Term | Lookups |
|---|---|
include: | 1, plus everything in the record it includes |
a, mx, ptr, exists:, redirect= | 1 each |
ip4:, ip6:, all | 0 |
The includes are where it adds up. Each sending service you add asks for one, so every include costs at least 1, and some cost more because their record includes another (SendGrid's costs 2 as of October 2026). Google Workspace and Microsoft 365 cost 1 each today. Add a newsletter tool, a CRM, a helpdesk, a billing system and the website's own server, and a record passes 10 without anyone noticing, often years after the first include went in.
The SPF checker follows the chain and shows the total next to the record.
Ways to fix it
- Remove senders you no longer use. The usual find is an include for a tool the company left years ago. It is the safest fix.
- Drop a, mx and ptr unless your own web or mail server really sends mail. ptr is deprecated anyway.
- Move a sender to a subdomain. Many newsletter and support tools can send as news.yourdomain.com, which has its own SPF record and its own 10 lookups.
- Rely on DKIM for some senders. DMARC passes when either SPF or DKIM passes and aligns. A sender with DKIM on your domain does not need to be in SPF at all.
"SPF flattening" replaces includes with the IP ranges they hold. It works until the provider changes its ranges, which they do without telling you. Use it only through a service that updates the list for you, or not at all.
Check it after
DNS changes show within minutes on most hosts. Run the domain through Warnwell again: "SPF needs 13 DNS lookups (limit 10)" goes away once the count is 10 or under.