SPF too many DNS lookups (permerror): how to count and fix
SPF lookup limit medium Email authentication · 7 of 100 points
What it inspects
This scanner follows include: and redirect= recursively and counts the terms that cause a DNS lookup: include, a, mx, ptr, exists and redirect. It also counts void lookups, which are lookups that return nothing. Verdicts: PASS for 8 or fewer lookups and at most 2 void lookups. WARN for 9 or 10 lookups (one change from breaking) or more than 2 void lookups. FAIL for more than 10 lookups, an include or redirect of a domain that does not exist or has no single SPF record, or an include loop. Not applicable when there is no single valid SPF record to count (see the spf check); SKIP when a lookup could not be completed.
Why it matters
RFC 7208 allows at most 10 DNS-querying terms per SPF evaluation. Above that, receivers must return a permanent error, which most treat as an SPF failure for all your mail. This often happens silently when you add another include: for a new email service.
How to verify by hand
# bash: read the record, then repeat for each include it names
dig +short TXT example.com
dig +short TXT _spf.provider.example
# PowerShell
Resolve-DnsName -Name example.com -Type TXT | Select-Object -ExpandProperty Strings
Resolve-DnsName -Name _spf.provider.example -Type TXT | Select-Object -ExpandProperty Strings
Count every include, a, mx, ptr, exists and redirect you meet, nested ones included.How to fix
Remove includes for services you no longer use, and replace stable ones with ip4:/ip6: ranges.
-
Delete include: entries for services that no longer send as your domain.
-
Replace a/mx terms or small includes with literal address ranges (ask the provider for them):
example.com. IN TXT "v=spf1 ip4:203.0.113.0/24 ip6:2001:db8::/32 include:_spf.provider.example -all"ip4 and ip6 terms cost no lookups. Remember to update them if the provider changes its ranges.
-
Fix any include or redirect that points at a name with no SPF record.