SPF: too many DNS lookups

What counts as a lookup

The limit comes from RFC 7208, section 4.6.4. These mechanisms each cost one lookup: include, a, mx, ptr, exists and the redirect modifier. ip4, ip6 and all cost nothing.

Lookups inside an include count too. include:_spf.google.com is one lookup in your record, but Google's record includes others, and those count against your 10 as well. That is why a record with five includes can need fifteen lookups.

There is a second limit: no more than 2 void lookups, meaning names that return no records. An include pointing at a service you closed is a common cause.

Find your real count

Most SPF tools count only the includes you can see. The SPF checker expands every include the way a receiving server does, so the number it shows is the one that matters.

Four ways to get under 10

1. Remove services you no longer use. Old newsletter tools, CRMs and help desks are often still listed.
2. Move a service to a subdomain. Send marketing from news.yourdomain.com with its own SPF record, so it no longer counts against your main domain.
3. Use the provider's sending domain. Many email services authenticate with their own return-path domain and DKIM, and do not need to be in your SPF at all. Check their setup docs.
4. Flatten the record. Replace includes with the IP ranges they resolve to. It works immediately, but goes stale when a provider changes its ranges, so it needs re-checking. The free flattening tool writes the records, and monitoring tells you when they change.

The Fix Kit reads your domain's live DNS and writes the corrected SPF, DMARC and DKIM records for your mail provider, ready to paste. See what it contains for free; the records are $1.

Free tools: full domain report   SPF checker   DMARC checker   DKIM checker   monitoring