Spot Downtime

SPF PermError: too many DNS lookups (and how to fix it)

SPF allows 10 DNS lookups. What counts toward the limit, how to count yours, and safe ways to get under it without breaking email.

· 4 min read · By the Spot Downtime team

SPF PermError: too many DNS lookups means your SPF record makes receiving servers do more than 10 DNS lookups to evaluate it. The SPF standard sets that limit, and when it's exceeded the result is a permanent error. Many receivers treat a PermError like a fail, so mail from your domain gets rejected or goes to spam, from every service, not just the newest one.

What counts toward the 10

MechanismCounts?
include:Yes, plus every lookup inside the included record
aYes
mxYes (plus up to 10 more lookups for the MX hosts)
exists:Yes
redirect=Yes
ptrYes, and it's deprecated: remove it
ip4: / ip6: / allNo

The trap is include:. One include for a big provider can use three or four lookups on its own, because their record includes others. Five services later, you're over.

text
v=spf1 include:_spf.google.com include:spf.protection.outlook.com
       include:sendgrid.net include:mailgun.org include:servers.mcsv.net
       include:_spf.salesforce.com include:helpscoutemail.com a mx ~all
       ← easily 12+ lookups once the includes are expanded

Count yours

SPF, DKIM & DMARC checkerCheck your SPF record, see whether it's valid, and find out what's wrong with it.DNS lookupLook up the TXT records of each included domain to see what they add.

How to get under the limit

Remove what you don't use

Old includes for services you cancelled years ago are the easiest win. So are a and mx, if your website and mail servers don't send mail themselves.

Rely on DKIM for some services

DMARC passes when either SPF or DKIM passes and aligns. Many marketing and helpdesk tools send with their own bounce domain anyway, so their SPF include doesn't help your DMARC at all. Set up DKIM with your domain for them, and drop their include.

Use a subdomain for bulk mail

Send newsletters from news.example.com with its own SPF record. Each domain has its own 10-lookup budget, and your main domain's reputation is kept separate.

Flatten carefully

Replacing includes with the ip4: ranges they contain removes lookups, but providers change their IPs without telling you. Only flatten with a tool that updates the record automatically.

Other SPF PermErrors

  • Two SPF records on the same domain: merge them into one v=spf1 record.
  • Syntax errors like include: example.com (with a space) or a missing v=spf1.
  • More than 2 void lookups: includes pointing at domains that no longer exist.

SPF records get edited by whoever sets up the next tool, so it's easy to break one by accident. A DNS monitor on your TXT record alerts you when it changes. For the bigger picture, see SPF, DKIM and DMARC explained.

Keep reading