Mail Sorcery

The SPF DNS Lookup Limit Explained

Before You Continue

If SPF itself still feels a bit fuzzy, start here:

./demystifying-spf.md

For a broader look at how SPF records get messy in the first place, see ./how-can-you-break-spf.md. Then continue with this guide.

You add one innocent include. That include brings friends. The friends bring more friends. Suddenly SPF is over capacity and DNS is quietly judging your life choices.

This is the SPF DNS lookup limit, and it’s one of the most common reasons SPF quietly stops working without anyone changing a single character in the record.

The Rule: Maximum 10 DNS Lookups

An SPF record is allowed a maximum of 10 DNS lookups during evaluation. This limit exists in the SPF specification (RFC 7208) to prevent SPF checks from turning into an unbounded chain of DNS queries every time someone sends an email.

Here’s the part that catches people off guard: this limit isn’t about how long or short your SPF record looks. A short, clean-looking record can still blow past 10 lookups if it includes other records that themselves include more records.

Which Mechanisms Count Toward The Limit

Not every part of an SPF record costs a DNS lookup. The mechanisms that do count include:

include – pulls in another domain’s SPF record
a – looks up the A record of a domain
mx – looks up the MX records of a domain, and then the A records of each of those
exists – performs a DNS lookup to check if a record exists
redirect – redirects evaluation to another domain’s SPF record

Mechanisms like ip4, ip6, and the qualifiers (-all, ~all, +all) do not count toward the limit, because they don’t require an additional DNS query.

Why Nested Includes Are The Real Problem

This is where things get sneaky. Say your SPF record has:

v=spf1 include:spf.protection.outlook.com include:mail.marketingplatform.com include:mail.crmplatform.com -all

That looks like three lookups. Reasonable, right? Except each of those includes points to another SPF record, which may itself contain more includes. A single marketing platform’s SPF record might reference two or three additional domains behind the scenes for regional mail servers or delivery infrastructure.

Suddenly your “three includes” are actually costing seven or eight lookups once nested includes are counted. Add one more system, and you’re over the limit without ever seeing it coming, because your own record still only shows three lines.

What Happens When You Exceed The Limit

When SPF evaluation exceeds 10 DNS lookups, the result is a PermError (permanent error).

A PermError means the receiving mail server cannot reliably evaluate your SPF record at all. Depending on the receiving server’s policy, this can result in:

Legitimate mail being marked as spam
Mail being rejected outright
DMARC alignment failing, even though your intent was correct

The frustrating part is that this failure is often invisible until someone reports missing emails. Your SPF record hasn’t visibly changed, so it’s easy to assume SPF isn’t the problem. It usually is.

Why This Matters More As Companies Grow

Every SaaS platform added to a business is another potential include. Every include is a black box you don’t control, maintained by someone else, that can change its own lookup cost without warning you. A vendor restructuring their own SPF infrastructure can push you over the limit even if you changed nothing on your end.

This is exactly why blindly adding SPF includes for every new tool is dangerous, and why removing genuinely unused systems isn’t just tidiness, it’s maintenance that keeps mail flowing.

Janitor Tip 🧹

Use an SPF lookup checker tool to count the actual, fully-resolved number of DNS lookups your record generates, not just the number of includes you can see. Several free tools online will walk the entire chain for you. Do this after adding any new system, not just when something breaks.

Suggested Image

A simple diagram showing a single SPF record at the top branching into multiple “include” boxes, each of which branches further into nested includes, visually filling up a counter that reads “10/10” with a warning symbol once the limit is reached.