SPF too many DNS lookups
RFC 7208 limits SPF evaluation to 10 DNS lookups. Exceeding that triggers PermError. Receivers cannot validate SPF. Each include:, a, mx, ptr, and exists mechanism in the evaluation chain counts, including nested includes inside delegated records.
Three steps to fix it
List every `include:` in your SPF record and open each included SPF to count nested lookups. ESP + M365 + Google often exceed 10 together.
Remove unused includes (old ESPs, retired marketing tools) and consolidate sending through fewer authorized paths.
If you still exceed 10 lookups, use SPF flattening or split sending across subdomains (e.g., `mail.example.com` for marketing, root domain for corporate mail).
Verify the fix once it's live.
Count SPF lookups confirms the change is correct before you move on.
FAQ
Common questions
Do void lookups count toward the limit?+
No. Void lookups (mechanisms that match no record) do not count, but invalid includes that error may still cause PermError.
Does mx mechanism always count as lookups?+
The mx mechanism triggers a lookup for the MX record; if multiple MX hosts are listed, additional a/aaaa lookups for those hosts may count toward the limit.
Can I have two SPF records?+
No. Multiple SPF TXT records on one domain cause PermError. Merge into a single v=spf1 record.