SPF "permerror: too many DNS lookups" (more than 10): how to fix it

What's happening: SPF allows at most 10 DNS lookups while checking your record. Every include:, a, mx, ptr, exists and redirect counts, including the ones nested inside other includes. Go over 10 and SPF returns permerror, which receivers treat as a fail.

How to fix it

  1. List what's in your SPF and remove services you no longer send from (old CRMs and help desks are the usual leftovers).
  2. Drop a, mx and ptr unless mail really leaves from those hosts. Each costs a lookup, and ptr is deprecated.
  3. Move bulk or marketing tools onto a subdomain (for example news.yourdomain.com) with its own SPF, so the root record only covers your mailbox provider.
  4. Rely on DKIM for tools that sign with your domain: DMARC passes on DKIM alone, so they don't all need to sit in SPF.
  5. Recheck. The free grader counts the real nested lookups for you.

Not sure which record is wrong? Check your domain free: it shows which of SPF, DKIM and DMARC is failing, in 5 seconds, no signup.

Other fix guides