Skip to main content
Email Security

SPF 10-Lookup Limit: How to Fix It

Vysiro Team · January 28, 2026 · Updated March 2026 · 10 min read

What is SPF and Why Does the 10-Lookup Limit Exist?

SPF (Sender Policy Framework) is an email authentication protocol that lets domain owners declare which mail servers are authorized to send email on their behalf. It works by publishing a TXT record in DNS that lists authorized IP addresses and domains. When a receiving server gets an email, it checks the sender's IP against the SPF record to decide whether to trust it.

The problem is that SPF records can reference other domains via the includemechanism, and those domains can reference yet more domains. Left unchecked, a single SPF lookup could trigger dozens or even hundreds of recursive DNS queries — creating a denial-of-service vector against DNS infrastructure.

To prevent this, RFC 7208, Section 4.6.4 imposes a hard limit: SPF evaluation must not result in more than 10 DNS mechanisms or modifiers that cause a lookup. If your record exceeds this limit, the SPF check returns a permerror, and the email effectively fails SPF — regardless of whether the sender was actually authorized.

What Counts as a Lookup (and What Does Not)

Not every SPF mechanism triggers a DNS lookup. Understanding which ones count is the first step to fixing your record.

MechanismCounts?Why
includeYesTriggers a DNS TXT lookup on the referenced domain, which may itself contain more lookups
aYesResolves the domain's A (or AAAA) record to match against sender IP
mxYesResolves the domain's MX records, then resolves each MX hostname to an IP
redirectYesReplaces the current SPF evaluation with the referenced domain's SPF record
existsYesPerforms an A record lookup on a macro-expanded domain name
ip4NoDirectly specifies an IPv4 address or CIDR range — no DNS query needed
ip6NoDirectly specifies an IPv6 address or CIDR range — no DNS query needed
allNoMatches everything — a catch-all with no DNS resolution

Important: nested include lookups count toward the total. If include:_spf.google.comitself contains 3 more includes, those 3 plus the original include all count — totaling 4 lookups just for Google Workspace.

How to Check Your SPF Lookup Count

You cannot tell your lookup count just by looking at your SPF record, because each include can contain nested includes that are not visible in your record. You need a tool that recursively resolves every mechanism and counts the total.

Vysiro's free SPF Flattener tool does exactly this. Enter your domain and it will show you your current lookup count, every nested include chain, and a flattened version of your record that stays under the limit. You can also run a full domain scan to see your SPF lookup count alongside 15 other security categories.

# Example: checking lookup count via dig dig +short TXT example.com | grep "v=spf1" # Output: "v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:sendgrid.net include:spf.mailchimp.com include:_spf.salesforce.com ~all" # That is 5 includes visible - but Google alone uses 3-4 nested includes, # so the real count is likely 12-15 lookups (over the limit).

Why You Hit the 10-Lookup Limit

Modern organizations use far more email-sending services than SPF was designed to handle. Here are the most common causes:

Multiple Email Service Providers (ESPs)

Each ESP you add requires an includein your SPF record. Mailchimp, SendGrid, HubSpot, Postmark, Amazon SES — each one costs 1-3 lookups depending on their own nested includes. Using just 3-4 ESPs can exhaust your entire budget.

Microsoft 365 + Google Workspace

Many organizations use both (e.g., Google Workspace for corporate email, Microsoft 365 for a subsidiary or partner). Google's SPF include chain alone consumes 3-4 lookups, and Microsoft's consumes 2-3. Together, that is 5-7 lookups before you add anything else.

CRM and Marketing Automation

Salesforce, HubSpot, Marketo, Pardot, and similar tools each send email on your domain's behalf and require their own SPF include. A sales team using Salesforce plus a marketing team using HubSpot adds 2-4 more lookups.

Support and Transactional Tools

Zendesk, Freshdesk, Intercom, and transactional email services like Postmark or Mailgun each add another include. Even internal tools like Jira Service Management or Confluence can send email that needs SPF authorization.

A typical mid-size company might have Google Workspace (4 lookups) + SendGrid (1) + Salesforce (2) + Zendesk (1) + HubSpot (2) + Mailchimp (1) = 11 lookups— already over the limit, and that is before accounting for any other services.

4 Ways to Fix the SPF 10-Lookup Limit

Method 1: SPF Flattening

SPF flattening resolves all include mechanisms recursively and replaces them with the underlying ip4 and ip6 addresses. Since ip4 and ip6 do not count toward the lookup limit, a fully flattened record can authorize dozens of services with zero DNS lookups.

# Before flattening (12 lookups - OVER LIMIT): v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:sendgrid.net include:spf.mailchimp.com ~all # After flattening (0 lookups): v=spf1 ip4:209.85.128.0/17 ip4:74.125.0.0/16 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/14 ip4:167.89.0.0/17 ip4:198.2.128.0/18 ip4:205.201.128.0/20 ~all

Use Vysiro's SPF Flattener to generate your flattened record automatically. The tool resolves every include chain and outputs a ready-to-publish record.

Method 2: Remove Unused Includes

Over time, SPF records accumulate includes for services that are no longer in use. A marketing tool you cancelled two years ago might still have its include in your record, wasting a precious lookup.

Audit your SPF record by checking each include against your actual sending services. For each one, ask: does this service still send email on our behalf? If not, remove it. Common culprits include trial accounts for ESPs, decommissioned CRM systems, and legacy marketing tools.

If you have DMARC reporting enabled (and you should), your aggregate reports will show you exactly which IPs are sending email from your domain. Cross-reference these IPs with your SPF includes to identify which ones are actually being used.

Method 3: Use Subdomains for Different Services

Each domain gets its own 10-lookup budget. By sending marketing email from marketing.example.com, transactional email from notifications.example.com, and corporate email from example.com, you effectively triple your lookup budget.

# Root domain: corporate email only (4 lookups) example.com TXT "v=spf1 include:_spf.google.com ~all" # Marketing subdomain (3 lookups) marketing.example.com TXT "v=spf1 include:spf.mailchimp.com include:sendgrid.net ~all" # Transactional subdomain (2 lookups) notifications.example.com TXT "v=spf1 include:spf.postmarkapp.com ~all"

This approach also improves deliverability. If your marketing email gets spam complaints, it affects the subdomain reputation instead of your root domain. Make sure to configure DMARC records for each subdomain as well.

Method 4: Consolidate ESPs

If you are using multiple ESPs that serve similar purposes, consolidate them. Instead of Mailchimp for newsletters and SendGrid for drip campaigns and Postmark for transactional email, evaluate whether a single provider can handle all your needs.

Reducing from 4 ESPs to 2 can save 4-6 lookups. This is not always feasible — different tools have different strengths — but it is worth evaluating when you are near the limit.

SPF Flattening Best Practices

If you choose SPF flattening (Method 1), follow these practices to avoid breaking your email delivery:

1. Automate re-flattening on a schedule

Email providers change their IP ranges without notice. Google, Microsoft, and SendGrid all rotate IPs regularly. If you flatten once and never update, your record becomes stale and legitimate emails start failing. Set up automated re-flattening at least weekly.

2. Keep a backup of your original record

Always save your original SPF record with all the include mechanisms before flattening. If something goes wrong with the flattened version, you need to be able to revert quickly. Store it in a comment in your DNS management tool or a shared document.

3. Test after every change

After publishing a flattened record, send test emails to Gmail, Outlook, and Yahoo and verify SPF passes. Check the email headers for "spf=pass" in the Authentication-Results header. Vysiro's scanner can verify this in seconds.

4. Watch the 450-character TXT record limit

Heavily flattened records with many ip4/ip6 entries can exceed DNS TXT record size limits. If your flattened record is very long, you may need to split it across multiple TXT strings (within a single record) or combine flattening with subdomain delegation.

5. Monitor DMARC reports for regressions

After flattening, watch your DMARC aggregate reports for any increase in SPF failures. A spike in failures after flattening usually means an IP range was missed or has changed since you flattened.

What Happens If You Exceed 10 Lookups

Exceeding the 10-lookup limit is not a soft warning — it causes a hard failure in SPF processing. Here is the cascade of consequences:

SPF Permerror Cascade

1. SPF Record Exceeds 10 Lookups

Receiver processes your SPF record and hits the limit

2. SPF Returns "permerror"

Permanent error — SPF evaluation aborts entirely

3. DMARC SPF Alignment Fails

DMARC cannot use SPF for alignment since SPF did not pass

If DKIM Passes

Email may still pass DMARC via DKIM alignment

If DKIM Also Fails

DMARC fails → quarantine or reject per policy

The most dangerous aspect of exceeding the limit is that it often goes unnoticed. Your SPF record still lookscorrect in DNS — there is no syntax error. But the receiving server silently fails the SPF check because the evaluation budget is exhausted. Emails may still deliver if DKIM is configured and passing, which masks the problem until DKIM breaks too.

This is why regularly checking your lookup count is critical. Even if you were under 10 lookups last month, a provider changing their include chain can push you over the limit without any changes on your end.

Fix Your SPF Record with Vysiro

Vysiro's free SPF Flattener tool analyzes your SPF record, counts every nested lookup, and generates a flattened version you can publish directly to DNS. No signup required.

For ongoing monitoring, Vysiro's domain scanner checks your SPF lookup count alongside 15 other security categories including DMARC, DKIM, DNSSEC, MTA-STS, and more. Get a TrustScore from 0 to 1000 and actionable fix recommendations in seconds.

Check your SPF lookup count for free

Paste your domain and get your lookup count, flattened record, and fix recommendations instantly.

Flatten SPF Record

Frequently Asked Questions

What is the SPF 10-lookup limit?+
RFC 7208, Section 4.6.4 specifies that SPF processing must not result in more than 10 DNS mechanisms that require a lookup (include, a, mx, redirect, exists). If your SPF record exceeds 10 lookups, receiving servers return a permerror and treat the SPF check as failed.
Do ip4 and ip6 mechanisms count toward the limit?+
No. The ip4 and ip6 mechanisms do not require a DNS lookup - they are matched directly against the connecting IP address. Only mechanisms that trigger a DNS query count: include, a, mx, redirect, and exists.
What is SPF flattening?+
SPF flattening is the process of resolving all include mechanisms recursively and replacing them with the resulting ip4 and ip6 addresses. This converts DNS-lookup-heavy records into lookup-free records, bringing you back under the 10-lookup limit.
Is SPF flattening safe?+
SPF flattening is safe when automated. The main risk is that the IP addresses behind include mechanisms can change without notice. If you flatten manually and never update, your SPF record becomes stale and legitimate emails may fail. Automated tools like Vysiro re-flatten on a schedule to keep records current.
What happens if I exceed 10 lookups?+
The receiving mail server returns an SPF permerror result. This means SPF fails, which causes DMARC alignment to fail on the SPF side. If DKIM also fails or is not configured, the email will be quarantined or rejected depending on your DMARC policy.
Can I have more than one SPF record?+
No. RFC 7208 requires exactly one SPF TXT record per domain. If a domain has multiple SPF records, the result is a permerror. If you need to authorize many senders, combine them into a single record or use SPF flattening.

Secure Your Domain Today

Scan your domain for free. Get a TrustScore across 30 security categories in under 60 seconds.

More in Guides

1 article

Related Articles