SPF PermError "Too Many DNS Lookups": How to Count and Fix the 10-Lookup Limit

If a checker says your SPF record returns permerror or "too many DNS lookups", every email you send is failing SPF, no matter which server sent it. The cause is a hard rule in the SPF standard (RFC 7208): a receiving server may perform at most 10 DNS lookups while evaluating your record. Go over, and the whole record is treated as broken. Here's how to count yours and get back under the limit without breaking mail.

What counts as a lookup

• Each costs one lookup: include:, a, mx, ptr, exists:, and redirect=.
• Nested lookups count too. include:_spf.google.com looks like one, but it points to further includes, so it costs several. Microsoft 365, Salesforce, and many help-desk tools nest the same way.
• Free: ip4:, ip6:, and all cost zero lookups.

A typical small business hits the limit by stacking Google Workspace or Microsoft 365, plus a newsletter tool, a CRM, a help desk, an invoicing app, and an old provider nobody removed.

Count your lookups

Pull your record first:

dig +short TXT yourdomain.com | grep spf1

On Windows: nslookup -type=TXT yourdomain.com. Then look up each include: target the same way and add up every mechanism in the chain. A free SPF checker does the counting for you. Aim for 8 or fewer so a provider adding a range later doesn't tip you over. Also confirm you only have one TXT record starting with v=spf1; two SPF records is its own permerror.

Fix 1: Remove includes you don't need

This solves most cases and costs nothing.

• Delete includes for tools you no longer use (an old email platform, a trial you cancelled).
• Delete ptr. It's deprecated and wastes a lookup.
• Delete a and mx unless your website server or inbound mail server actually sends your outbound mail. Most small businesses send through Google or Microsoft, so these are usually dead weight.
• Check whether each tool even needs to be there. SPF checks the hidden Return-Path domain, not the From address. Many newsletter and help-desk tools (Mailchimp, HubSpot, Zendesk, and others) use their own Return-Path domain, so their include in your record does nothing. Send a test email through the tool, open the raw headers, and look at Return-Path. If it shows the provider's domain, the include can go, and DMARC will pass through DKIM instead.

Fix 2: Give heavy senders their own subdomain

Each subdomain has its own SPF record and its own budget of 10:

yourdomain.com        TXT "v=spf1 include:_spf.google.com -all"
news.yourdomain.com   TXT "v=spf1 include:servers.mcsv.net -all"

Your DMARC record must keep relaxed SPF alignment (the default, or aspf=r) for subdomain mail to align with your main domain.

Fix 3: Rely on DKIM for tools that support it

DMARC passes when either SPF or DKIM passes and aligns with your domain. If a tool lets you set up DKIM on your own domain (most marketing and CRM tools do), turn that on, confirm dkim=pass in a test message's headers, and you may be able to drop its SPF include. See our DKIM checker guide.

Fix 4: Flatten, carefully, as a last resort

Flattening replaces an include with the ip4:/ip6: ranges behind it, which cost zero lookups. The catch: providers change their IP ranges without telling you, and a flattened record goes stale silently. Only flatten senders with stable, rarely changing IPs (often servers you control), never Google or Microsoft by hand, and if you must flatten more, use a service that re-flattens automatically.

After the fix

Re-check the record, then send a test message to a Gmail account and open "Show original". You want spf=pass (or dkim=pass) and dmarc=pass. DNS changes usually show up within an hour, though some hosts take longer. New to SPF? Start with our SPF record checker guide.

Check it the fast way

Want a second opinion in under a minute? Scan your site free with SiteShield. It checks whether your domain publishes a valid SPF record and a DMARC policy, plus HTTPS, security headers, and privacy basics and shows your score and every issue found. If you'd rather skip the trial and error, the $14 fix bundle gives you copy-paste fixes written for your exact site.

Check your site free