Definition
The SPF lookup limit is a hard cap of 10 DNS lookups that a receiving server will perform while evaluating a single SPF record. The limit, defined in RFC 7208, exists to prevent malicious or poorly designed SPF records from forcing a receiver into an excessive number of DNS queries. When a record requires more than 10 lookups, SPF evaluation stops and returns a permerror, which is treated as a failure.
How It Works
An SPF record is built from mechanisms such as include, a, mx, and ptr, each of which may trigger one or more DNS queries. The mechanisms that consume lookups are:
| Mechanism | Lookups consumed |
|---|---|
include: |
One per include, plus any lookups the included record itself requires |
a |
One, or more if multiple addresses resolve |
mx |
One for the MX lookup, plus lookups for each resulting host |
ptr |
One or more, and it is discouraged |
The 10-lookup limit applies to the total across the entire evaluation chain, including nested includes. When the count exceeds 10, the receiver returns permerror, which causes the message to fail SPF. The receiving server does not simply ignore the overflow; it treats the whole evaluation as invalid.
Why the Limit Causes Problems
Many legitimate senders unknowingly exceed the limit because their records chain through several third-party providers, each with its own include. A marketing team that adds email platforms, a CRM, an invoicing tool, and a survey provider can easily accumulate more than 10 lookups.
The consequences are serious:
- Messages fail SPF, weakening email authentication.
- DMARC may fail if the sender relies on SPF alignment.
- Deliverability can suffer as a result.
The fix is to flatten the record by resolving the included records manually and copying only the relevant IP ranges into the main record, eliminating nested includes. Some senders use subdomains to isolate different sending services, keeping each domain's SPF record small.
Example
A company's SPF record includes five marketing services, and one of those includes three more providers internally. The total lookups reach 13. Email from the company begins failing SPF with permerror. The team flattens the record, inlining the IP ranges, and the lookup count drops to 7, restoring SPF pass results.
Was this useful?
Related Glossary Terms
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
Alt Text
Alt text is the written alternative to an image in an email, displayed when images are blocked, slow to load, or consumed by screen readers.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Management
Bounce management is the process of handling emails that are rejected by mailbox providers, including classification, removal of bad addresses and protection of sender reputation.
Frequently Asked Questions
A `permerror` means the SPF record could not be evaluated correctly, most commonly because it exceeded the 10-lookup limit. Receivers treat `permerror` as a failure, so the message does not pass SPF.
Use an SPF validation tool, which reports the number of DNS lookups a record requires. Many tools also warn when a record approaches the limit, making them useful before publishing changes.
Yes. The limit is based on the number of lookups the evaluation would perform, regardless of caching. The safest approach is to keep the total well under 10.
Flattening is the process of replacing nested `include` mechanisms with the actual IP addresses they represent, reducing the lookup count. It requires care, because the underlying records must be re-synced whenever a provider changes its IPs.