What is the SPF 10-DNS-lookup limit?

And If your SPF record causes the receiving server to make more than 10 DNS lookups while evaluating it, the whole check fails. Not "fails softly" but fails with a permanent error, called a "permerror," which many receiving servers treat the same as a hard SPF fail.

Here's why the limit exists: when a receiving server evaluates your SPF record, some mechanisms require additional DNS lookups to resolve. An include:mailchimp.com means the server has to look up Mailchimp's SPF record to see what IPs are authorized. If Mailchimp's record includes another domain, that's another lookup. This can chain. To prevent these chains from becoming a denial-of-service vector against DNS infrastructure, the SPF specification caps it at 10.

Which mechanisms consume lookups? include:, a, mx, ptr, and exists all require DNS lookups and count toward the limit. ip4: and ip6: don't, because they specify an address directly without a lookup.

But The problem is that if you're using multiple ESPs, you can hit 10 lookups surprisingly fast. Each include: for a sending service might itself resolve to a record with more include: statements. Some ESPs' SPF records are nested several levels deep.

If you're getting SPF failures with "permerror" in your headers, a lookup-count issue is worth checking. Our free SPF checker counts your lookups and tells you if you're over the limit.

The fix is usually to either remove unused include: statements (do you still send from all those ESPs?), use ip4: ranges directly for services that publish their IPs, or look into SPF flattening services that pre-resolve your record into static IP ranges. SPF flattening has its own tradeoffs, especially when the ESP changes its IP ranges, so it's worth understanding what the limit means before jumping straight to a flattening service.

If you're sending through multiple services and this is getting complicated, the SOS hotline can help you figure out the cleanest approach for your setup.