SPF fail: 10-lookup limit explained — the honest fix

Introduction

Why one new vendor can break your email authentication

The SPF lookup cap is a hard stop: once you exceed it, many receivers will softfail or drop messages, and support won’t magic it away. The real fix is pruning includes and safely flattening records, not adding yet another include or fiddling with ~all. Do this properly and you’ll restore deliverability without a game of DNS whack‑a‑mole.

What a permerror does to deliverability

The result is a permerror, not a plain fail. Many receivers treat it like a fail, hurting every mail stream on your domain.

What Counts Toward the 10-Lookup Limit

Mechanisms that trigger a lookup

RFC 7208 caps SPF evaluation at 10 DNS lookups per check. The limit counts total lookups, not just include statements.

• Count: include, a, mx, ptr, exists, and the redirect modifier
• Do not count: all, ip4, and ip6, since they need no DNS query

How nested vendor includes inflate the count

Each include can contain more include statements, and each one triggers its own lookup.

A record with five includes can pass 10 once you follow the chain. Vendors such as your ESP or CRM often nest their own third-party includes inside their SPF record, so you do not control the final number.

How to Check Your Current Lookup Count

Using an SPF record checker

The fastest route is an SPF record checker. It walks the full chain of includes and reports the total lookup count, with a flag if you are at or over the limit.

Run your domain through it before and after every vendor change. You will also see SPF syntax errors, multiple SPF records, and any unresolvable include.

Tracing includes manually

If you want to verify the result by hand, follow the record step by step:

1. Pull the TXT record that starts with v=spf1.
2. Open each included domain’s record and count its lookups too.
3. Repeat for every nested include until none remain.

Add up the totals. Anything above 10 triggers the permerror.

Ways to Get Back Under 10

Remove unused vendors and swap lookups for IP ranges

Start with cleanup. Old newsletter tools and past providers pile up in SPF records, and removing them often brings you under 10.

• Delete includes for vendors you no longer use.
• Replace a, mx, or include terms with ip4 or ip6 where the addresses are stable.
• Drop mx unless your mail server truly sends from it.

Subdomain delegation and SPF flattening

Give a sender its own subdomain, such as one for marketing mail. That subdomain gets a fresh 10-lookup limit.

SPF flattening converts includes into IP addresses. Dynamic flattening, like Managed SPF from EasyDMARC, keeps those addresses current when vendors change them.

FAQ

What happens when SPF exceeds 10 lookups?

The receiver returns a permerror and may reject or flag your mail, depending on its policy.

Does flattening fix it permanently?

Only if the IP addresses stay current. Static flattening goes stale when vendors change their ranges, so dynamic flattening is safer.

Can I publish two SPF records?

No. Multiple SPF records also cause a permerror. Merge everything into one record.

Conclusion

An SPF permerror is fixable. Audit your lookup count, remove stale vendors, and move heavy senders to subdomains.