SPF lookup limit

The rule

RFC 7208 limits an SPF check to ten DNS lookups. If evaluating your record needs an eleventh, the result is a permanent error, and receivers treat it like a failure. The limit exists to stop SPF from being used to flood DNS servers.

What counts, and what does not

Counts toward the ten: include, a, mx, ptr, exists, and redirect.

Does not count: ip4, ip6, and all.

The catch is that an include costs one lookup plus every lookup inside the record it points to. A single include:_spf.google.com chains to several further records, so it spends more than one. Add a sequencer, a CRM, a billing tool and a helpdesk and you can reach eleven without ever writing one yourself.

There is also a smaller limit: more than two lookups that return nothing (void lookups) is an error too.

How to see where you stand

Look the record up and expand each include by hand, or paste the domain into the deliverability checker.

How to get back under

• Remove senders you no longer use. Stale includes are the usual cause.
• Replace an include with literal ip4: ranges where a provider's addresses are stable. This is a trade: you now maintain them.
• Move different mail streams to different subdomains, each with its own SPF record and its own budget of ten.
• Be wary of "SPF flattening" services; they work, but a flattened record goes stale if the provider changes its addresses.

See SPF and SPF include.