spf permerror too many dns lookups 10 lookup limit exceeded
Fixes SPF permerror from exceeding the 10 DNS lookup limit: flatten includes, remove dead mechanisms, and retest. Use when receivers log 'SPF permerror: too many DNS lookups' or SPF returns none despite a valid record. Not for SPF fail, which means the sending IP is not authorized.
TL;DR
SPF allows at most 10 DNS lookups while evaluating a record; nested includes blow past it and receivers treat the result as a permanent error. Flatten the record to direct IPs, drop stale includes, and stay under the limit.
spf permerror too many dns lookups 10 lookup limit exceededUse this when
- Receivers report SPF permerror or 'too many DNS lookups'.
- SPF shows none or permerror even though the TXT record exists.
- You added a new mail vendor and SPF broke the same day.
Not for this skill when
- SPF fail, meaning the IP is not in the record.
- DKIM signature failures.
- DMARC alignment problems on forwarded mail.
Steps
- Pull the current TXT record and count lookups: every include, a, mx, ptr, and redirect counts. Verify: you have a written count above 10.
- Identify which vendors still send for you; remove includes for dead tools. Verify: the remaining include list matches active vendors only.
- Ask big vendors for their dedicated IP ranges and replace the include with ip4 entries. Verify: the lookup count drops under 10 with margin.
- Flatten anything still nested, keeping the record under 255 characters per string. Verify: a DNS query returns the full record intact.
- Test with a mail-tester service or an actual send to Gmail and check headers. Verify: Authentication-Results shows spf=pass.
Variant phrasings
spf too many dns lookups permerror
Common phrasing of the error.
spf 10 lookup limit exceeded fix
The limit-angle search.
spf permerror flatten includes
The fix-angle search.
Compatibility: Any DNS provider and any sender; the 10-lookup limit is in the SPF spec (RFC 7208).
Why it happens
SPF was designed with a lookup cap to stop DNS amplification attacks. Every include pulls in another record, and vendor records include their own vendors, so three includes can silently become fourteen.
Edge cases / pitfalls
- The count includes lookups from nested includes; audit recursively, not just your own line.
- Flattened records go stale when a vendor changes IPs; re-check quarterly.
- Multiple TXT records starting with v=spf1 at the same name break everything; keep exactly one.
- Macros in SPF count against the limit too; keep the record simple.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_KLoGg8xpUS4bsHaYS9GABQ