SPF Troubleshooting Guide
How to Fix SPF PermError: 10-Lookup Limit Exceeded
SPF evaluation is strictly limited to ten DNS-querying mechanisms per RFC 7208. Modern SaaS stacks routinely exceed that limit through nested include statements, causing receiving servers (Google, Yahoo, Microsoft) to reject email with an SPF PermError.
1. Count DNS Mechanisms, Not Vendors
The 10-lookup limit applies to DNS queries triggered by mechanisms such as include, a,mx, exists, and redirects. Adding a single vendor like Zendesk or Google can internally branch into 3 to 4 nested lookups.
2. Audit & Remove Stale Senders
Never flatten blindly. Inspect aggregate DMARC report telemetry to verify if legacy marketing or CRM tools are still dispatching mail. Removing inactive vendors immediately recovers lookups without architectural complexity.
3. Isolate Mail Streams with Subdomains
Instead of bloating your apex root SPF record with every marketing, billing, and product sender, delegate subdomains (e.g. billing.yourdomain.com for Stripe, news.yourdomain.com for newsletters). Each subdomain has its own independent 10-lookup quota.
4. Dynamic SPF Flattening with Refresh Controls
SPF flattening resolves nested include domains down to direct ip4 and ip6 CIDR ranges. However, because cloud ESPs continuously add IP ranges, static records will drift. Flattened records require automated polling and instant DNS synchronization.
Frequently Asked Questions (SPF Lookup Limits)
What is the SPF 10-DNS-lookup limit?
Per RFC 7208 section 4.6.4, evaluating an SPF record must not perform more than 10 DNS lookups across include, a, mx, ptr, and exists mechanisms. Exceeding this limit causes receiving mail servers to generate an immediate SPF PermError (Permanent Error).
What causes an SPF PermError (Permanent Error)?
An SPF PermError is most commonly triggered by exceeding 10 DNS lookups due to nested include statements from cloud email providers (Google Workspace, Zendesk, Salesforce, Mailchimp), syntax typos, or having multiple SPF TXT records on a single domain.
How do you fix an SPF record that exceeds 10 lookups?
To fix the 10-lookup limit: 1) Audit and remove decommissioned sending vendors, 2) Delegate marketing or transactional email streams to dedicated subdomains (e.g., mail.yourdomain.com), and 3) Use an automated SPF flattener that replaces nested includes with monitored IP blocks.
Is manual SPF flattening safe?
Manual SPF flattening is dangerous because major email providers frequently rotate their sending IP blocks without notice. Static flattening without automated polling can cause legitimate customer emails to be rejected when provider IPs change.
Suspect your SPF record is exceeding the limit? Use the free DmarcLock Scanner to check your exact lookup count and test the instant SPF flattener.