The SPF 10 DNS lookup limit

SPF evaluation is capped at 10 DNS lookups per check. The mechanisms include, a, mx, ptr, and exists, plus the redirect modifier, each consume one or more lookups, counted recursively through every included record. When an evaluation would need an eleventh lookup, the receiver stops and returns permerror, a permanent error that makes the record useless everywhere at once. This limit, defined in RFC 7208 to prevent SPF from being abused for DNS amplification, is the most common way otherwise correct SPF records break.

What counts and what does not

Counting toward the limit: every include, a, mx, ptr, and exists mechanism, and the redirect modifier. Free: ip4, ip6, all, and the initial fetch of the record itself. The mx mechanism carries a second cost layer: resolving each MX hostname to addresses, capped at 10 per mx term. There is also a separate cap of 2 void lookups, queries that return no answer, so dead hostnames in a record can trigger permerror even under the main budget.

Why records go over: recursive counting

An include costs one lookup plus everything the included record spends internally, and vendor records nest. include:_spf.google.com expands to three further includes, four lookups total. A record with four popular SaaS vendors can quietly evaluate to twelve lookups while containing only four visible terms. Vendors also change their records without notice, which means your record's lookup count changes without any edit on your side. Records that passed for years fail one Tuesday because a vendor restructured.

What permerror costs

Permerror is not a partial result: the entire record is discarded, as if the domain published broken SPF, because it did. Under DMARC, SPF then contributes nothing, and authentication rests entirely on DKIM alignment. Domains with healthy aligned DKIM survive with an invisible degradation; domains relying on SPF for DMARC start failing DMARC outright, and at p=quarantine or p=reject their mail stops arriving. The failure is global and simultaneous at every receiver, which is also the diagnostic tell.

Getting back under budget

The strategic fix is reducing what SPF has to carry. DMARC needs one aligned mechanism per message, and DKIM alignment survives forwarding, vendor changes, and the lookup budget entirely. A sender whose every stream signs with aligned DKIM can treat SPF as supporting evidence rather than a single point of failure, which shrinks both the record and the stakes.

Checking your count

Online counters (the dmarcian SPF Surveyor, MxToolbox, and most DMARC platforms) resolve the full include tree and report the effective lookup total on demand. Treat 8 as the practical ceiling, leaving headroom for vendor drift, and re-check whenever a vendor is added and on a schedule. Validation tooling and the wider failure vocabulary are covered in the testing and troubleshooting entry.