Home · Troubleshoot · SPF lookups

SPF · PermError · 10 lookups

Fixing SPF PermError: too many DNS lookups (10-lookup limit explained)

22 October 2026

Receivers evaluate at most ten DNS-causing mechanisms and modifiers per SPF check (include, a, mx, ptr, exists, redirect). The eleventh produces a permanent error—treated like failure for authorization, and harmful under DMARC. On the free audit this is finding SPF_LOOKUP_LIMIT.

What you will see

• Bounce or header text: PermError / “too many DNS lookups”.
• Static audit: “11 DNS lookups… The limit is 10” plus a critical finding card with a guide link.
• The SPF lookup tree stops at the term that crossed the limit.

Fix it

1. Run the static audit. Open the SPF section and count DNS-causing terms in the tree—not characters in the string.
2. Remove dead include: targets (retired ESPs, duplicate Google/Microsoft includes).
3. Replace mx / a with explicit ip4: / ip6: where the addresses are stable.
4. Split traffic: marketing on mail.brand.example or em.brand.example with its own SPF, keeping the org domain lean.
5. Use the audit’s flatten preview only as a draft of already-literal ip4/ip6. It does not publish DNS and does not expand macros.
6. On a paid domain, use Flatten SPF on the domain card to host a single include: of literal addresses—then replace the customer SPF TXT yourself.
7. Publish one SPF TXT. Two SPF TXTs are themselves a PermError (SPF_MULTIPLE).

What not to do

• Do not “fix” SPF with +all.
• Do not nest includes that re-introduce the same third parties.
• Do not assume Hosted DMARC rewrites SPF—it only hosts the DMARC record (Flatten SPF is a separate paid action).

After publishing, re-run the audit until SPF_LOOKUP_LIMIT disappears, then watch DMARC aggregate reports before tightening policy.