SPF 10-Lookup Limit: How to Fix It
Vysiro Team · January 28, 2026 · Updated March 2026 · 10 min read
What is SPF and Why Does the 10-Lookup Limit Exist?
SPF (Sender Policy Framework) is an email authentication protocol that lets domain owners declare which mail servers are authorized to send email on their behalf. It works by publishing a TXT record in DNS that lists authorized IP addresses and domains. When a receiving server gets an email, it checks the sender's IP against the SPF record to decide whether to trust it.
The problem is that SPF records can reference other domains via the includemechanism, and those domains can reference yet more domains. Left unchecked, a single SPF lookup could trigger dozens or even hundreds of recursive DNS queries — creating a denial-of-service vector against DNS infrastructure.
To prevent this, RFC 7208, Section 4.6.4 imposes a hard limit: SPF evaluation must not result in more than 10 DNS mechanisms or modifiers that cause a lookup. If your record exceeds this limit, the SPF check returns a permerror, and the email effectively fails SPF — regardless of whether the sender was actually authorized.
What Counts as a Lookup (and What Does Not)
Not every SPF mechanism triggers a DNS lookup. Understanding which ones count is the first step to fixing your record.
| Mechanism | Counts? | Why |
|---|---|---|
| include | Yes | Triggers a DNS TXT lookup on the referenced domain, which may itself contain more lookups |
| a | Yes | Resolves the domain's A (or AAAA) record to match against sender IP |
| mx | Yes | Resolves the domain's MX records, then resolves each MX hostname to an IP |
| redirect | Yes | Replaces the current SPF evaluation with the referenced domain's SPF record |
| exists | Yes | Performs an A record lookup on a macro-expanded domain name |
| ip4 | No | Directly specifies an IPv4 address or CIDR range — no DNS query needed |
| ip6 | No | Directly specifies an IPv6 address or CIDR range — no DNS query needed |
| all | No | Matches everything — a catch-all with no DNS resolution |
Important: nested include lookups count toward the total. If include:_spf.google.comitself contains 3 more includes, those 3 plus the original include all count — totaling 4 lookups just for Google Workspace.
How to Check Your SPF Lookup Count
You cannot tell your lookup count just by looking at your SPF record, because each include can contain nested includes that are not visible in your record. You need a tool that recursively resolves every mechanism and counts the total.
Vysiro's free SPF Flattener tool does exactly this. Enter your domain and it will show you your current lookup count, every nested include chain, and a flattened version of your record that stays under the limit. You can also run a full domain scan to see your SPF lookup count alongside 15 other security categories.
Why You Hit the 10-Lookup Limit
Modern organizations use far more email-sending services than SPF was designed to handle. Here are the most common causes:
Multiple Email Service Providers (ESPs)
Each ESP you add requires an includein your SPF record. Mailchimp, SendGrid, HubSpot, Postmark, Amazon SES — each one costs 1-3 lookups depending on their own nested includes. Using just 3-4 ESPs can exhaust your entire budget.
Microsoft 365 + Google Workspace
Many organizations use both (e.g., Google Workspace for corporate email, Microsoft 365 for a subsidiary or partner). Google's SPF include chain alone consumes 3-4 lookups, and Microsoft's consumes 2-3. Together, that is 5-7 lookups before you add anything else.
CRM and Marketing Automation
Salesforce, HubSpot, Marketo, Pardot, and similar tools each send email on your domain's behalf and require their own SPF include. A sales team using Salesforce plus a marketing team using HubSpot adds 2-4 more lookups.
Support and Transactional Tools
Zendesk, Freshdesk, Intercom, and transactional email services like Postmark or Mailgun each add another include. Even internal tools like Jira Service Management or Confluence can send email that needs SPF authorization.
A typical mid-size company might have Google Workspace (4 lookups) + SendGrid (1) + Salesforce (2) + Zendesk (1) + HubSpot (2) + Mailchimp (1) = 11 lookups— already over the limit, and that is before accounting for any other services.
4 Ways to Fix the SPF 10-Lookup Limit
Method 1: SPF Flattening
SPF flattening resolves all include mechanisms recursively and replaces them with the underlying ip4 and ip6 addresses. Since ip4 and ip6 do not count toward the lookup limit, a fully flattened record can authorize dozens of services with zero DNS lookups.
Use Vysiro's SPF Flattener to generate your flattened record automatically. The tool resolves every include chain and outputs a ready-to-publish record.
Method 2: Remove Unused Includes
Over time, SPF records accumulate includes for services that are no longer in use. A marketing tool you cancelled two years ago might still have its include in your record, wasting a precious lookup.
Audit your SPF record by checking each include against your actual sending services. For each one, ask: does this service still send email on our behalf? If not, remove it. Common culprits include trial accounts for ESPs, decommissioned CRM systems, and legacy marketing tools.
If you have DMARC reporting enabled (and you should), your aggregate reports will show you exactly which IPs are sending email from your domain. Cross-reference these IPs with your SPF includes to identify which ones are actually being used.
Method 3: Use Subdomains for Different Services
Each domain gets its own 10-lookup budget. By sending marketing email from marketing.example.com, transactional email from notifications.example.com, and corporate email from example.com, you effectively triple your lookup budget.
This approach also improves deliverability. If your marketing email gets spam complaints, it affects the subdomain reputation instead of your root domain. Make sure to configure DMARC records for each subdomain as well.
Method 4: Consolidate ESPs
If you are using multiple ESPs that serve similar purposes, consolidate them. Instead of Mailchimp for newsletters and SendGrid for drip campaigns and Postmark for transactional email, evaluate whether a single provider can handle all your needs.
Reducing from 4 ESPs to 2 can save 4-6 lookups. This is not always feasible — different tools have different strengths — but it is worth evaluating when you are near the limit.
SPF Flattening Best Practices
If you choose SPF flattening (Method 1), follow these practices to avoid breaking your email delivery:
1. Automate re-flattening on a schedule
Email providers change their IP ranges without notice. Google, Microsoft, and SendGrid all rotate IPs regularly. If you flatten once and never update, your record becomes stale and legitimate emails start failing. Set up automated re-flattening at least weekly.
2. Keep a backup of your original record
Always save your original SPF record with all the include mechanisms before flattening. If something goes wrong with the flattened version, you need to be able to revert quickly. Store it in a comment in your DNS management tool or a shared document.
3. Test after every change
After publishing a flattened record, send test emails to Gmail, Outlook, and Yahoo and verify SPF passes. Check the email headers for "spf=pass" in the Authentication-Results header. Vysiro's scanner can verify this in seconds.
4. Watch the 450-character TXT record limit
Heavily flattened records with many ip4/ip6 entries can exceed DNS TXT record size limits. If your flattened record is very long, you may need to split it across multiple TXT strings (within a single record) or combine flattening with subdomain delegation.
5. Monitor DMARC reports for regressions
After flattening, watch your DMARC aggregate reports for any increase in SPF failures. A spike in failures after flattening usually means an IP range was missed or has changed since you flattened.
What Happens If You Exceed 10 Lookups
Exceeding the 10-lookup limit is not a soft warning — it causes a hard failure in SPF processing. Here is the cascade of consequences:
SPF Permerror Cascade
1. SPF Record Exceeds 10 Lookups
Receiver processes your SPF record and hits the limit
2. SPF Returns "permerror"
Permanent error — SPF evaluation aborts entirely
3. DMARC SPF Alignment Fails
DMARC cannot use SPF for alignment since SPF did not pass
If DKIM Passes
Email may still pass DMARC via DKIM alignment
If DKIM Also Fails
DMARC fails → quarantine or reject per policy
The most dangerous aspect of exceeding the limit is that it often goes unnoticed. Your SPF record still lookscorrect in DNS — there is no syntax error. But the receiving server silently fails the SPF check because the evaluation budget is exhausted. Emails may still deliver if DKIM is configured and passing, which masks the problem until DKIM breaks too.
This is why regularly checking your lookup count is critical. Even if you were under 10 lookups last month, a provider changing their include chain can push you over the limit without any changes on your end.
Fix Your SPF Record with Vysiro
Vysiro's free SPF Flattener tool analyzes your SPF record, counts every nested lookup, and generates a flattened version you can publish directly to DNS. No signup required.
For ongoing monitoring, Vysiro's domain scanner checks your SPF lookup count alongside 15 other security categories including DMARC, DKIM, DNSSEC, MTA-STS, and more. Get a TrustScore from 0 to 1000 and actionable fix recommendations in seconds.
Check your SPF lookup count for free
Paste your domain and get your lookup count, flattened record, and fix recommendations instantly.
Flatten SPF RecordFrequently Asked Questions
What is the SPF 10-lookup limit?+
Do ip4 and ip6 mechanisms count toward the limit?+
What is SPF flattening?+
Is SPF flattening safe?+
What happens if I exceed 10 lookups?+
Can I have more than one SPF record?+
Secure Your Domain Today
Scan your domain for free. Get a TrustScore across 30 security categories in under 60 seconds.