sendsend.email
Sign inStart building

Learn · 3 minute read

SPF error: too many DNS lookups (the 10 lookup limit)

SPF lets a receiving server make at most ten DNS lookups while it checks a record. Go past ten and SPF returns a permanent error, so your mail can fail authentication even though every sender is listed correctly.

What counts as a lookup

These mechanisms each cost one lookup: include, a, mx, ptr, exists and redirect. An include: also costs whatever the included record uses, so one include for a large service can use several. ip4, ip6 and all cost nothing.

How to find out

Run your domain through the free domain checker to see it. It counts the lookups for you. Otherwise, add up every include and expand each one by hand.

How to get under ten

  1. Remove services you no longer use. Old newsletters and trial tools are the usual cause.
  2. Drop a and mx unless you really send from those servers.
  3. Replace an include with fixed addresses (ip4:) only for a sender with stable addresses, and know you must keep them current.
  4. Move different mail to subdomains. Send marketing from news.example.com with its own SPF record, so each record has its own ten.

Why it matters

A permanent error counts as an SPF failure, which can push a message toward spam when DMARC depends on it. More on why mail goes to spam.

Common questions

Is the limit ten includes or ten lookups?

Ten DNS lookups in total, counting everything the included records use too. Ten includes can easily be more than ten lookups.

Does flattening SPF help?

It can, by replacing includes with address lists, but those lists go stale when a provider changes its servers. Subdomains are the safer fix.

Will mail definitely fail if I am over ten?

SPF returns a permanent error. Whether the message is rejected depends on the receiver and on your DKIM and DMARC setup, but you should not rely on it.

Check your own domainSee your SPF, DKIM and DMARC in seconds, free.
Open the checker

Keep reading

SendSend is an email API that checks these records for you and tells you when a domain is verified. Get started free.