The SPF 10-lookup limit: why adding one more email tool breaks it

SPF (Sender Policy Framework) is the DNS record that lists which servers may send email for a domain. It has a rule many people never hear about until mail starts going to spam: evaluating the record may take at most 10 DNS lookups. Go over, and the result is a permanent error (permerror). Most receivers treat that as an SPF failure, for every message.

What counts as a lookup

The limit comes from RFC 7208, section 4.6.4. These terms each cost one lookup:

• include:
• a and mx
• ptr (deprecated, avoid it)
• exists:
• the redirect= modifier

ip4:, ip6: and all are free. The catch is that the count is recursive: every include: points at another SPF record, and every lookup inside that record counts towards your 10 too.

How a normal small business ends up over the limit

A typical record grows one tool at a time:

v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com include:servers.mcsv.net include:sendgrid.net include:mail.zendesk.com ~all

That looks like five lookups. But several of those providers' records contain their own includes, so the real total can be well above five, and the next tool someone adds (a booking system, a billing platform, a marketing automation tool) tips it over 10. Nothing warns anyone when it happens. Email just starts failing authentication.

Providers change their records over time, so the only reliable number is the one you count today. Our free SPF lookup counter follows every include and shows the total.

Other SPF mistakes that look harmless

• Two SPF records. A domain must have exactly one TXT record starting with v=spf1. Two records make SPF fail, even if each one is correct on its own.
• +all allows every server on the internet to send as the domain. It cancels SPF completely.
• ?all (neutral) tells receivers not to treat unknown senders as suspicious.
• No all at the end. The record does not say what to do with anything else.

How to fix a record that is over the limit

1. Inventory real senders. Which tools actually send mail as this domain today? Old trials and retired tools are the easiest lookups to remove.
2. Move bulk senders to a subdomain. Newsletters can usually send from news.example.com with their own SPF record. This is often the cleanest fix.
3. Prefer DKIM where the tool supports it. DMARC passes if either SPF or DKIM passes and aligns. A tool that signs with DKIM on your domain does not strictly need to be in SPF.
4. Flatten carefully, if you must. Replacing includes with the IP ranges they resolve to removes lookups, but those ranges change. Only flatten with a process (or a service) that keeps the list updated.
5. Re-count after every change, and keep the record under about 8 lookups to leave room for the next tool.

Why it matters more since 2024

Gmail, Yahoo and Microsoft now require authenticated mail from anyone sending in volume, and they treat authentication failures far more harshly than before. An SPF record that quietly broke last year is now a deliverability problem. See Google, Yahoo and Microsoft sender rules, explained.