AuthenticationDeliverability

SPF PermError: Too Many DNS Lookups. What It Means and How to Fix It

Nestmarketing Team · · 2 min read

This one hides well. Your SPF record looks fine. It lists every service you use. Then a header check shows spf=permerror and you can't work out why.

The usual reason: your record needs more than 10 DNS lookups, and the SPF standard says that's a hard fail.

What counts as a lookup

When a receiving server checks SPF, some parts of your record need extra DNS queries:

Mechanism Counts as a lookup?
include: Yes, plus every lookup inside the included record
a, mx Yes
exists:, redirect= Yes
ptr Yes (and avoid it, it's deprecated)
ip4:, ip6:, all No

The nested part is what gets people. include:_spf.google.com alone pulls in several more lookups. Add Microsoft 365, a CRM, a helpdesk, an invoicing tool and a marketing platform, and you're past 10 before you notice.

There's also a second, lesser-known limit: no more than 2 "void" lookups, meaning lookups that return nothing. Old includes for services you cancelled are a common cause.

How to check

Use any SPF checker that shows the lookup count. Paste your domain and look for the total. Anything at 9 or 10 is one new tool away from breaking.

Three ways to fix it

1. Remove what you don't use

Look at every include: and ask whether that service still sends email as your domain. We regularly find records with includes for tools a company stopped using two years ago. This is the cleanest fix.

2. Move senders to subdomains

This is our preferred approach for growing teams. Instead of one SPF record covering everything:

  • yourbrand.com → Google Workspace or Microsoft 365 only
  • mail.yourbrand.com → your newsletter platform
  • billing.yourbrand.com → your invoicing tool

Each subdomain gets its own SPF record with its own 10-lookup budget. It also keeps reputation separate, so a noisy marketing tool can't drag down your everyday mail.

For cold email we go one step further and use separate outreach domains altogether.

3. Replace includes with IP addresses

If a service sends from a small, stable set of IPs, you can list them with ip4: instead of include:. IP mechanisms cost no lookups.

Be careful. If the provider changes IPs and you don't update the record, SPF fails silently. "SPF flattening" tools automate this, but we'd only use one that updates automatically.

A tidy example

Before (12 lookups, broken):

v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:sendgrid.net include:mailgun.org include:servers.mcsv.net include:zoho.in -all

After (split by purpose):

yourbrand.com        v=spf1 include:_spf.google.com -all
news.yourbrand.com   v=spf1 include:sendgrid.net -all

Don't forget DMARC

Fixing SPF is half the job. For DMARC to pass, the domain that passes SPF must match your From domain. If you send from news.yourbrand.com but your From address says yourbrand.com, relaxed alignment still works because they share the same organisational domain. We explain alignment properly in why DMARC fails when SPF and DKIM pass.

If your DNS has grown messy over the years, we can audit it for you.

Related articles