The SPF 10-lookup limit, explained
An SPF record may trigger at most 10 DNS lookups during evaluation (RFC 7208 §4.6.4). Exceed that and the result is PermError, which means SPF fails entirely — as if you had published no SPF record at all. It does not degrade gracefully. include, a, mx, ptr, exists and redirect each cost lookups; ip4, ip6 and all cost none.
What counts toward the 10 — and what doesn't
| Term | Counts? | Cost |
|---|---|---|
include: | Yes | 1 + everything inside it, recursively |
a | Yes | 1, regardless of how many A records return |
mx | Yes | 1 — not one per MX host |
ptr | Yes | 1 (deprecated — do not use it) |
exists: | Yes | 1 |
redirect= | Yes | 1 — but ignored entirely if an all is present |
ip4: / ip6: | No | 0 |
all / exp= | No | 0 |
mx as "1, plus one per
MX record returned". That is wrong. Per RFC 7208 §4.6.4, the mx mechanism costs
exactly one lookup toward the 10. The A/AAAA lookups for each MX host are
bounded by a separate per-mx limit of 10 and do not add to the main
count. A domain with five MX hosts spends 1 of its budget, not 6. Over-counting
here flags perfectly valid records as broken and sends people off flattening records that were
never in trouble.
Why it fails hard instead of softly
The intuition most people have — "I went slightly over, so SPF is slightly weaker" — is wrong, and it is the reason this bug survives so long in production. Crossing the limit produces PermError. A receiver treats PermError as an authentication failure. You get no partial credit for the first ten mechanisms.
The knock-on effect is the part that actually costs you money. If your DMARC policy is passing
on the strength of SPF rather than DKIM, then SPF PermError means DMARC fails, and at
p=reject your mail is refused at SMTP time. It never lands in spam. It never
arrives. See SPF PermError for the full failure chain.
Count your domain's live lookups
Enter a domain to see its live lookup count.
How to fix it
In rough order of how much you should prefer them:
- Remove senders you no longer use. Free, zero risk, and the most common
win. Old ESP
includes linger for years after the contract ended. Each one may be costing you several lookups. - Drop
ptrif you have it. It is deprecated, slow, and costs a lookup for no security benefit. - Use a subdomain per sender. Send marketing from
mail.example.comwith its own SPF record and its own budget of 10. This is the structurally correct fix and it is what large senders do. - Flatten, carefully. Resolve
includes down toip4ranges, which cost zero. This works, and it introduces a maintenance burden that will bite you if you forget about it — read SPF flattening before you commit to it.
Flatten your record
A flattened record spends zero lookups on includes.
Frequently asked
How many DNS lookups does SPF allow?
Ten. RFC 7208 §4.6.4 caps the number of DNS-querying mechanisms and modifiers evaluated for a single SPF check at 10. Exceeding it is a PermError.
Does the mx mechanism count as one lookup or one per MX host?
One. The mx mechanism costs exactly one lookup toward the limit of 10, no matter how many MX hosts are returned. The A/AAAA resolution of each returned MX host is bounded by a separate per-mx limit of 10 and does not add to the main count. Many popular checkers get this wrong and count one-per-host, which falsely flags healthy records as broken.
What happens when SPF exceeds 10 lookups?
The evaluation returns PermError. Receivers treat PermError as an authentication failure, not as a soft warning, so SPF provides you no benefit at all — and if your DMARC policy relies on SPF rather than DKIM alignment, DMARC fails too.
Do ip4 and ip6 mechanisms count toward the SPF lookup limit?
No. ip4 and ip6 are matched directly against the connecting IP with no DNS query, so they cost zero lookups. This is why flattening an SPF record — replacing include mechanisms with the IP ranges they resolve to — reduces the count.
Related
- SPF PermError — PermError means SPF failed permanently — you get no authentication benefit at all.
- SPF flattening, and the maintenance debt nobody mentions — Flattening replaces include mechanisms with the IP ranges they resolve to, dropping your DNS lookup count to zero.
- SPF vs DKIM vs DMARC — Three records, three different jobs.
Automate this → — free tier, public pricing, API key emailed in about thirty seconds. No call with anyone.