Skip to content

How do I fix "SPF record too many DNS lookups"?

By Ash, Founder, HosteazePublished 2 min read

The short answer

SPF allows a maximum of 10 DNS lookups. Every include, a, mx, ptr, exists and redirect term counts, including the ones hidden inside each include. Go over and SPF returns a permanent error, so it fails for all your email. Fix it by removing services you no longer use and dropping unnecessary a and mx terms.

Tangled mess of electrical cables on a telegraph pole against a blue sky
Credit: Yotsapat via Pixabay

Your SPF record has a budget, and it's small. The SPF standard caps the number of DNS lookups a receiving server will make while checking it at 10. It's there to stop SPF checks being used to flood DNS servers, and it's easy to blow through once a business has added a few email tools over the years.

Why does SPF have a 10-lookup limit?

Each time a receiving server checks your SPF, it may need to look up more records to find the full list of allowed servers. The standard says that after 10, it must stop and return a permerror. A permanent error means SPF fails for every email you send, not just the ones from the eleventh service.

These terms each cost one lookup:

  • include:
  • a and mx
  • ptr (deprecated, so remove it anyway)
  • exists:
  • redirect=

ip4:, ip6: and all cost nothing.

Why does my record go over when it only has four includes?

Because includes can contain includes. Each include: costs one lookup, and if the record it points to has its own includes, those count towards your 10 as well. When we checked in October 2026, Google's _spf.google.com and Microsoft's spf.protection.outlook.com listed IP addresses directly, so they cost one lookup each. Some marketing, helpdesk and CRM tools nest two or three levels deep, so four includes can quietly cost eight or more.

How do I count my SPF lookups?

  1. Look up your domain's TXT record in the free Google Admin Toolbox Dig tool and find the one starting v=spf1.
  2. Count each include:, a, mx, ptr, exists and redirect in it.
  3. For each include, look up that domain's TXT record too and count its terms in the same way.
  4. Add them up. A free SPF checker will do this for you and show the total.

How do I get back under 10?

Work through these in order, checking the count after each:

  1. Remove services you no longer use. The old newsletter tool from 2019 is a classic.
  2. Remove a and mx terms unless your own web or mail server actually sends email. Many records have them by default for no reason.
  3. Remove ptr entirely.
  4. Check if a service now prefers DKIM. Many newsletter and CRM tools authenticate with DKIM instead, and their help pages say the SPF include is optional.
  5. Move bulk email to a subdomain, such as news.yourdomain.co.uk, with its own SPF record.
  6. Flatten only what's left, using a service that keeps the IP addresses up to date.

Once you're under the limit, send a test email to a Gmail account and check it shows SPF: PASS under Show original. If your emails were going to spam, this alone can fix it. For setting up the rest, see how to set up SPF, DKIM and DMARC.

Frequently asked questions

Do ip4 and ip6 terms count towards the limit?

No. ip4, ip6 and all don't need a DNS lookup, so you can list as many IP addresses as you like without using up the 10.

Is SPF flattening a good idea?

Only as a last resort. Flattening replaces includes with the IP addresses behind them, but providers change those addresses without warning. Use a service that re-flattens automatically, or fix the root cause instead.

Can I split my SPF record into two?

Not on the same domain. Two SPF records break SPF. You can send some email, such as newsletters, from a subdomain like news.yourdomain.co.uk, which gets its own SPF record and its own 10 lookups.

Sources

  1. RFC 7208, Sender Policy Framework (section 4.6.4, DNS lookup limits)
  2. Microsoft, Set up SPF to identify valid email sources
  3. Google Admin Toolbox, Dig

Keep reading

Yellow wooden signposts pointing in different directions on a mountain pathQuestionA record vs CNAME, what's the difference?An A record points a domain name straight at an IP address, such as 203.0.113.10. A CNAME points a name at another name, which then supplies the address. Use an A record for your root domain and a CNAME for subdomains like www when your host gives you a hostname. A CNAME can't sit on the root domain.Email and domains · 13 October 2026The Earth from space covered in a web of glowing network connections, showing how DNS answers spread worldwideQuestionHow long does DNS propagation take?Most DNS changes are visible within a few minutes to an hour, but some take up to 48 hours. The wait depends on the record's TTL, which tells servers how long to keep the old answer, and on whether you changed a record or your nameservers. Nameserver changes are usually the slowest.Email and domains · 13 October 2026Traffic light showing a red stop signal under a blue bicycle signalQuestionDMARC p=none vs quarantine vs reject, which should I use?p=none tells receivers to deliver failing email as normal and just send you reports. p=quarantine sends failing email to spam. p=reject blocks it completely. Start at none, read the reports until every service you use passes, then move to quarantine and finally reject. Skipping straight to reject can block your own invoices.Email and domains · 12 October 2026Magnifying glass and pen resting on printed spreadsheets, ready to check the detailsQuestionHow do I check if my domain has DMARC?Look up the TXT record at _dmarc.yourdomain.com. The quickest way is the free Google Admin Toolbox Dig tool. Enter _dmarc followed by your domain, choose TXT, and look for a value starting v=DMARC1. If nothing comes back, your domain has no DMARC record and you should add one.Email and domains · 12 October 2026Open red mailbox with a stream of envelopes flying away from it, like email going astrayQuestionWhy are my emails going to spam?The most common reason is missing or broken email authentication. If your domain has no SPF, DKIM or DMARC records, Gmail and Outlook can't prove the email is really from you. After that come a poor sender reputation, a shared server with a bad history, and messages that look like marketing. Check authentication first.Email and domains · 12 October 2026

Want email on your own domain?

Hosteaze hosting plans let you set up mailboxes on your own domain. See what each plan includes.

See hosting plans