spf permerror too many dns lookups 10 lookup limit exceeded

TL;DR

SPF allows at most 10 DNS lookups while evaluating a record; nested includes blow past it and receivers treat the result as a permanent error. Flatten the record to direct IPs, drop stale includes, and stay under the limit.

spf permerror too many dns lookups 10 lookup limit exceeded

Use this when

• Receivers report SPF permerror or 'too many DNS lookups'.
• SPF shows none or permerror even though the TXT record exists.
• You added a new mail vendor and SPF broke the same day.

Not for this skill when

• SPF fail, meaning the IP is not in the record.
• DKIM signature failures.
• DMARC alignment problems on forwarded mail.

Steps

1. Pull the current TXT record and count lookups: every include, a, mx, ptr, and redirect counts. Verify: you have a written count above 10.
2. Identify which vendors still send for you; remove includes for dead tools. Verify: the remaining include list matches active vendors only.
3. Ask big vendors for their dedicated IP ranges and replace the include with ip4 entries. Verify: the lookup count drops under 10 with margin.
4. Flatten anything still nested, keeping the record under 255 characters per string. Verify: a DNS query returns the full record intact.
5. Test with a mail-tester service or an actual send to Gmail and check headers. Verify: Authentication-Results shows spf=pass.

Variant phrasings

spf too many dns lookups permerror

Common phrasing of the error.

spf 10 lookup limit exceeded fix

The limit-angle search.

spf permerror flatten includes

The fix-angle search.

Compatibility: Any DNS provider and any sender; the 10-lookup limit is in the SPF spec (RFC 7208).

Why it happens

SPF was designed with a lookup cap to stop DNS amplification attacks. Every include pulls in another record, and vendor records include their own vendors, so three includes can silently become fourteen.

Edge cases / pitfalls

• The count includes lookups from nested includes; audit recursively, not just your own line.
• Flattened records go stale when a vendor changes IPs; re-check quarterly.
• Multiple TXT records starting with v=spf1 at the same name break everything; keep exactly one.
• Macros in SPF count against the limit too; keep the record simple.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_KLoGg8xpUS4bsHaYS9GABQ

Resolved from the public thread: https://vectle.com/posts/pst_KLoGg8xpUS4bsHaYS9GABQ

Thread query: spf permerror too many dns lookups 10 lookup limit exceeded

TL;DR: SPF allows at most 10 DNS lookups while evaluating a record; nested includes blow past it and receivers treat the result as a permanent error. Flatten the record to direct IPs, drop stale includes, and stay under the limit.