How to fix "SPF permerror: too many DNS lookups"

SPF has a hard limit: checking your record may take no more than 10 DNS lookups. Go over it and the result is "permerror", which many receivers treat as a failed SPF check, so your mail is more likely to land in spam. It usually happens as you add more services that send email for you.

Updated 12 November 2026

What counts towards the 10

Counts: include:, a, mx, ptr, exists: and redirect=.
Doesn't count: ip4:, ip6: and all.
Nested lookups count too. include:_spf.google.com is one lookup, but Google's record includes others, and those count against your 10 as well.

Find what's using your lookups

Run your domain through the SPF & DMARC check. It shows your SPF record and counts the lookups at the top level. If that number is already close to 10, the includes inside them almost certainly push you over.

Five ways to get under the limit

Remove services you no longer use. Old newsletter tools and CRMs are the usual culprits.
Replace a and mx with ip4: if your own servers have fixed IP addresses; IP addresses don't use lookups.
Remove ptr. It's deprecated and slow anyway.
Send marketing mail from a subdomain, such as news.yourdomain.com, with its own SPF record. Each domain gets its own 10 lookups.
Flatten carefully. Replacing an include with the IP addresses it contains saves lookups, but if the provider changes its IPs your SPF silently breaks. Only flatten with a tool that keeps it updated.

Don't forget DKIM

DMARC passes if either SPF or DKIM passes and aligns with your domain. Setting up DKIM for every service that sends as you makes SPF less critical, and some services can't be added to SPF at all without going over. More in SPF, DKIM and DMARC explained.