The 10 SPF Lookup Limit: Why It Matters

The 10 Lookup Limit

RFC 7208, the specification that defines SPF (Sender Policy Framework), establishes a hard limit of 10 DNS lookups during SPF evaluation. This limit exists for important reasons:

Prevent DNS Amplification Attacks

Without a limit, attackers could craft SPF records that trigger thousands of DNS queries, overwhelming DNS servers.

Ensure Timely Email Processing

Email servers need to validate SPF quickly. Too many lookups would slow down mail delivery significantly.

Reduce Server Load

Limiting lookups prevents excessive resource consumption on both sending and receiving mail servers.

When your SPF record exceeds 10 lookups, receiving servers will return a PermError result, which most servers treat as an SPF failure. This can cause your emails to be rejected or marked as spam.

What Counts as a Lookup

The following SPF mechanisms and modifiers each consume one or more DNS lookups:

Mechanism	Lookups	Description
include:	1+	One lookup, plus any lookups in the included record
a	1	Looks up the A/AAAA record
mx	1+	One for MX lookup, plus one for each MX host's A record
ptr	1+	Reverse DNS lookup (deprecated, avoid using)
exists:	1	Checks if a domain has an A record
redirect=	1+	One lookup, plus all lookups in the target record

The include: mechanism is particularly dangerous because it recursively counts all lookups in the included SPF record. A single include can consume 3-5 lookups or more.

What Doesn't Count

These mechanisms do not require DNS lookups and can be used freely without affecting your lookup count:

ip4:

Directly specifies an IPv4 address or CIDR range (e.g., ip4:192.168.1.0/24)

ip6:

Directly specifies an IPv6 address or CIDR range (e.g., ip6:2001:db8::/32)

all

The catch-all mechanism at the end of your record (-all, ~all, ?all)

Pro tip: When possible, replace include: mechanisms with direct ip4: and ip6: entries to reduce your lookup count.

Example: An SPF Record That Exceeds the Limit

Here's a real-world example of an SPF record that exceeds the 10 lookup limit. This is common for organizations using multiple SaaS providers:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com
include:sendgrid.net include:amazonses.com include:mailchimp.com
include:zendesk.com include:freshdesk.com a mx -all

Let's count the lookups:

Mechanism	Lookups
include:_spf.google.com	3
include:spf.protection.outlook.com	2
include:sendgrid.net	1
include:amazonses.com	2
include:mailchimp.com	2
include:zendesk.com	2
include:freshdesk.com	1
a	1
mx	1
Total	15 lookups (exceeds limit!)

This record fails SPF validation due to PermError

How to Check Your Lookup Count

There are several ways to check how many DNS lookups your SPF record uses:

Using Online Tools

The easiest method is to use an SPF checker tool that recursively evaluates your record:

Our domain scanner shows your total lookup count
MXToolbox SPF Record Lookup
Kitterman SPF Validator

Using Command Line (dig/nslookup)

You can manually check your SPF record and trace includes:

# Check your main SPF record
dig TXT example.com +short

# Check an included SPF record
dig TXT _spf.google.com +short

# Using nslookup
nslookup -type=TXT example.com

You'll need to manually trace each include: and count the total lookups, which is why automated tools are recommended.

Strategies to Reduce Lookups

1. Remove Unused Includes

Audit your SPF record and remove includes for services you no longer use. Common culprits include:

Old email marketing platforms
Deprecated CRM systems
Former helpdesk solutions
Legacy email servers

2. Use Subdomains for Different Services

Instead of putting all services on your main domain, use dedicated subdomains:

# Main domain - core email only
example.com: v=spf1 include:_spf.google.com -all

# Marketing subdomain
marketing.example.com: v=spf1 include:mailchimp.com -all

# Support subdomain
support.example.com: v=spf1 include:zendesk.com -all

3. Replace Mechanisms with IP Addresses

If a service uses static IPs, replace the include with direct IP addresses:

# Before (1 lookup)
include:mail.example-service.com

# After (0 lookups)
ip4:192.0.2.1 ip4:192.0.2.2

Only do this if the service guarantees static IPs. If their IPs change, your emails will fail SPF.

4. Remove the 'a' and 'mx' Mechanisms

If your domain's A record or MX hosts don't send email, remove these mechanisms. They're often included by default but may not be necessary.

SPF Flattening

SPF flattening is a technique that replaces all include mechanisms with their resolved IP addresses, eliminating DNS lookups entirely.

How It Works

# Before flattening (3+ lookups)
v=spf1 include:_spf.google.com -all

# After flattening (0 lookups)
v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19
ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18
ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16
ip4:209.85.128.0/17 ip6:2001:4860:4000::/36
ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36
ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36
ip6:2c0f:fb50:4000::/36 -all

Pros of SPF Flattening

Eliminates DNS lookup limits entirely

Faster SPF validation (no recursive lookups)

Allows unlimited email service providers

Cons of SPF Flattening

Requires constant maintenance as provider IPs change

Creates very long SPF records (may hit 255-char TXT limit)

If IPs change and you don't update, emails fail SPF

Manual flattening is error-prone and time-consuming

The Maintenance Burden

Email service providers regularly add, remove, and change their sending IP addresses. Google, Microsoft, and other large providers may change IPs weekly or even daily. If you flatten your SPF record, you must:

Monitor all included SPF records for changes
Update your DNS record whenever IPs change
Handle DNS propagation delays during updates
Test thoroughly after each change

Recommendation: If you need flattening, consider using an automated SPF flattening service that monitors for IP changes and updates your DNS automatically. Manual flattening is not sustainable for most organizations.

Summary

1.SPF records are limited to 10 DNS lookups per RFC 7208
2.include, a, mx, ptr, exists, and redirect all count toward the limit
3.ip4, ip6, and all do not count toward the limit
4.Use online tools or dig to check your current lookup count
5.Reduce lookups by removing unused includes and using subdomains
6.SPF flattening eliminates lookups but requires ongoing maintenance

Resources

RFC 7208 - Sender Policy Framework (SPF)More Email Authentication Guides