How to fix SPF “too many DNS lookups”

An SPF record may make receiving mail servers do at most 10 DNS lookups. Go over, and the whole record fails with a permerror: as far as Gmail and Outlook are concerned you have no working SPF, so your email is more likely to land in spam or fail DMARC. It’s one of the most common hidden email problems, because every new service you add (“just add our include”) quietly pushes the count up. First see where you stand: run your domain through the SPF, DKIM & DMARC checker, which follows every include and shows “uses N of 10 allowed DNS lookups”.

What counts as a lookup

Counts (1 each): include:, a, mx, ptr, exists: and redirect=.
Nested lookups count too: include: loads the other company’s SPF record, and every include, a or mx inside it is added to your total. That’s why one line can cost 5 or 9.
Free (0): ip4:, ip6: and all.
Also a limit: no more than 2 “void” lookups (includes that point at a name with no SPF record, usually typos or services you’ve left).

What common services cost

Measured on 26 October 2026 (the include itself plus everything nested inside it). Providers change these, so always recount with the checker.

Service	Include	Lookups
Microsoft 365	`spf.protection.outlook.com`	1
Google Workspace	`_spf.google.com`	1
Amazon SES	`amazonses.com`	1
Brevo, Mailjet, MailerLite, Constant Contact, Zendesk, Shopify	(their own)	1 each
Zoho Mail, Proton Mail, SendGrid, Salesforce	(their own)	2 each
iCloud Mail	`icloud.com`	5
Mailgun	`mailgun.org`	5
Freshdesk	`email.freshdesk.com`	7
Mimecast (global include)	`_netblocks.mimecast.com`	9
Mimecast (South Africa)	`za._netblocks.mimecast.com`	1

How to fix it (in this order)

1. Remove services you no longer use

Old newsletter tools, a previous email host, a CRM you cancelled, a web host you moved away from. These are the most common cause, and removing them is free. If you’re not sure what an include is, search its name: it usually belongs to an obvious company.

2. Remove entries that are already covered

mx is redundant if your MX records point at Microsoft 365 or Google and you already include them. a is only needed if your website server itself sends email (contact forms on ordinary hosting). Duplicate includes count twice.

3. Check which services really need to be in SPF

SPF checks the hidden “return path” address of an email, not the From address people see. Many bulk senders (Mailchimp, Postmark, and SendGrid or Brevo once you’ve completed their domain authentication) use their own return path, so their include in your root record does nothing. For those, the record that matters is DKIM: set it up in the service, and DMARC passes through DKIM. Mailchimp in particular says no SPF entry is needed.

4. Use a regional or smaller include

Some providers publish lighter includes. The best-known South African example: Mimecast’s global include costs 9 lookups, but SA accounts can use za._netblocks.mimecast.com, which costs 1. Check your provider’s documentation for the include for your region.

5. Replace `a` and `mx` with fixed IPs

If your website or office mail server has a fixed IP address that doesn’t change, write it as ip4:196.25.1.10 (free) instead of a or mx (1 lookup each). Only do this for servers you control; if the IP changes, mail from it will fail.

6. Move bulk email to a subdomain

Send newsletters from news.yourdomain.com or invoices from billing.yourdomain.com. Each subdomain has its own SPF record and its own 10 lookups, and a problem with marketing mail can’t hurt the reputation of your main mailbox. Most newsletter tools support this in their sending-domain settings.

7. Flattening: the last resort

“Flattening” replaces includes with the IP addresses they currently contain. It gets you under 10, but providers change their IPs without warning, and a flattened record silently goes stale and starts failing. Only flatten with a service that re-checks and updates the record automatically, and keep Microsoft 365 or Google as normal includes.

Rebuild the record cleanly

The quickest way to apply fixes 1 to 3 is to start again: open the SPF record generator, type your domain (it reads your current record), untick what you don’t use, and it gives you one new record with a live lookup count. Replace the old TXT record with it (never add a second v=spf1 record), then check it with the DNS propagation checker and the SPF checker.

How to tell if you have this problem

The checker says “The record needs 12 DNS lookups; the limit is 10”.
In Gmail, open an email you sent, choose Show original: SPF says PERMERROR or “too many DNS lookups”.
DMARC reports show SPF “permerror” for your own servers.
Microsoft 365 message headers show spf=permerror.

Frequently asked questions

What is the SPF 10 lookup limit?

RFC 7208, the SPF standard, says checking an SPF record may trigger at most 10 DNS lookups. Every include, a, mx, ptr, exists and redirect counts, including the ones nested inside other companies’ includes. ip4, ip6 and all are free.

What happens if SPF has more than 10 lookups?

Receiving servers return a permanent error (permerror) and treat SPF as failed or missing. With DMARC in place your email can then fail DMARC unless DKIM passes, which often sends it to spam.

Does the 10 lookup limit include nested includes?

Yes. The count covers the whole tree: your includes, the includes inside them, and so on. That’s why one include can cost several lookups.

Is SPF flattening safe?

Only if a service keeps the flattened record up to date automatically. A manually flattened record breaks silently when a provider changes its IP addresses.

Can I have two SPF records to get more lookups?

No. Two SPF records on the same name make SPF fail. Use a subdomain for bulk email instead; each subdomain gets its own record and its own 10 lookups.