DNS guides

SPFBreaks authentication

SPF too many DNS lookups (over 10): how to fix it

SPF allows 10 DNS lookups. Past that, receivers return permerror and SPF fails for all your mail. Here's how to get back under the limit.

What it means

To evaluate SPF, a receiver resolves every include, a, mx, ptr, exists and redirect in your record, and in every record those point to. The standard caps this at 10 lookups; one more and the result is a permanent error.

Big providers use several lookups each (Google's include alone takes about four), so a record with five or six tools reaches the limit quickly.

Why it matters for cold email

Over the limit, SPF fails for every message, including those from servers you listed. DMARC then rests on DKIM alone, and any message without a valid DKIM signature fails DMARC.

How to fix it

  1. Remove includes for services you no longer use. This is usually enough.
  2. Drop a and mx mechanisms if those servers don't send mail.
  3. Move bulk or marketing tools to a subdomain (for example mail.yourdomain.com) with its own SPF record.
  4. For a service with a short, stable list of addresses, replace its include with ip4/ip6 entries, which cost no lookups. Only do this if the provider publishes fixed ranges.
  5. Re-run the checker: it shows the lookup count of the record as published.

Questions

Do ip4 and ip6 count towards the limit?

No. Only mechanisms that need a DNS query count: include, a, mx, ptr, exists and redirect.

What about SPF flattening services?

They replace includes with the current IP ranges and keep them updated. They work, but you depend on them noticing every change a provider makes. Removing unused senders or using a subdomain is simpler.

Related problems

Last checked 2026-10-21 against RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 7489 (DMARC). Full setup guide

Sending cold email? Outsquid re-checks these records for every sending domain every hour, so a broken one doesn't go unnoticed. How deliverability works