SPF PermError: too many DNS lookups — what it means and how to fix it

Your SPF check is coming back permerror with a note about too many DNS lookups. Here is what the 10-lookup limit is, how to count your lookups, and how to get back under it — in plain English.

Check your SPF record free — no signup

1. What the error actually means

When a mail server checks SPF, it fetches your v=spf1 TXT record and follows every mechanism in it. The SPF standard (RFC 7208) caps the mechanisms that trigger a DNS query at 10 per check: include, a, mx, ptr, exists, and redirect all count. ip4, ip6, and all are free.

If evaluating your record would take an 11th lookup, the receiver stops and returns permerror — a permanent error, not a pass and not a fail. Under DMARC that is worse than it sounds: a permerror means SPF can never produce an aligned pass for your domain, so your mail is relying entirely on DKIM.

2. Why your record went over the limit

The trap is that nested includes count too. Your record might list only four providers, but each include: can pull in a provider record that itself contains more includes. A typical accumulation looks like this:

v=spf1 include:_spf.google.com include:sendgrid.net
       include:servers.mcsv.net include:_spf.salesforce.com
       include:spf.protection.outlook.com ~all

Each of those expands to one or more further lookups when the receiver resolves it, and the total can pass 10 even though the record looks short. Records usually get here gradually — every new tool asks you to "just add our include" and nobody ever removes one.

3. Count your lookups

Resolve your record and walk the tree, counting every include, a, mx, ptr, exists, and redirect at every level:

dig +short TXT yourdomain.com
dig +short TXT _spf.google.com   # repeat for each include

Or skip the manual walk — our free SPF checker resolves the whole tree and tells you the total, and whether the syntax is otherwise valid.

4. Four ways to get back under 10

• Delete stale includes. The most common fix. If you stopped using a tool, remove its include. Audit each entry against what you actually send with today.
• Use ip4/ip6 for stable senders. If a system sends from addresses you control (your own server, a fixed relay), list the address directly — ip4:203.0.113.25 costs zero lookups.
• Move bulk mail to a subdomain. Send marketing mail from news.yourdomain.com with its own SPF record containing just that provider's include. Each domain gets its own 10-lookup budget, and a bulk provider's problems stop touching your root domain.
• Be careful with "SPF flattening." Some services replace includes with the resolved IP lists. It works, but providers change their IPs, so a flattened record silently rots unless something keeps it updated. Prefer the first three fixes.

5. While you fix it: make sure DKIM carries you

DMARC passes if either SPF or DKIM passes with alignment. If DKIM signing is enabled at each of your providers with your own domain, a temporary SPF permerror does not bounce your mail. Check your DKIM setup before you start editing DNS, not after. Our guide to SPF vs DKIM vs DMARC explains how the three fit together, and if DMARC itself is failing, see why DMARC fails and how to fix it.