What is the SPF 10-lookup limit and why does it exist?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
SPF is designed to let receiving mail servers check whether an email came from an authorized sender. To do that check, the receiving server has to look up your SPF record in DNS. Some of your SPF mechanisms then require more DNS lookups to resolve, and some of those might chain into even more. Without a limit, a single SPF check could trigger hundreds of DNS queries.
That's a problem for two reasons. First, it creates a potential denial-of-service vector: someone could craft SPF records that force receiving servers to make thousands of lookups, overwhelming their DNS resolvers. Second, it makes SPF evaluation slow and unpredictable, which undermines the whole point of having fast, consistent authentication.
So the SPF specification caps it: a maximum of 10 DNS lookups per evaluation. The mechanisms that consume lookups are include:, a, mx, ptr, and exists. If your SPF record (including any records that your includes reference) triggers more than 10 lookups total, the evaluation fails with a "permerror" result.
What permerror means in practice: It's not a soft failure. Many receiving servers treat permerror the same as a hard SPF fail. If you're seeing unexplained spam folder placement and you have a complex SPF record with many include: statements, a lookup count over 10 is a plausible cause.
The fix is usually to audit your record, remove include: entries for services you no longer use, or replace some include: mechanisms with direct ip4: ranges. Our free SPF checker counts your lookups and tells you if you're over.
For a practical guide to what you can do when you're over the limit, see the SPF 10-lookup limit.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
