dotvitals

SPF include chain contains a loop

HighConfirmedemail.spf.include-loop

What this check looks for

One of the records your SPF policy pulls in eventually points back at a record already in the chain. Mail servers evaluating it go in a circle and give up with an error.

Why it matters

A looping SPF policy is a permanent error for every receiver: no message from your domain can pass SPF, so SPF-based DMARC alignment fails for all of your mail.

When the check passes, your report says: “The SPF include chain resolves without looping”.

What it costs your score

When this check fails it removes 20 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.

It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.

Severity
high
Default confidence
confirmed
Status when triggered
fail
Deduction
20 points
Family cap
email-auth.spf · 35
Category
Email authentication
Module
Email spf
Fix owned by
dns host
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Break the cycle by removing the include that points back into the chain.

Until the loop is gone, SPF returns permerror for every message you send.

  1. Follow the chain shown above and find the record that re-enters it: ‹loop path›.

  2. Remove the offending include: from whichever record you control.

  3. If the loop is inside a provider's record, report it to them — you cannot fix their zone, but you can stop including it until they do.

How to confirm it worked

  • dig +short TXT ‹loop domain› — confirm it no longer includes a domain already in your chain

  • Re-test this finding.

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

Evaluating ‹domain› reached ‹loop domain› a second time along the chain ‹loop path›. RFC 7208 §4.6.4 does not name loops explicitly — it relies on the ten-lookup ceiling to terminate them — so receivers see the loop as permerror once the limit is hit rather than as a distinct diagnosis. We stop and report the loop directly because the ten-lookup message sends people looking for senders to remove when the real fault is a cycle.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email spf checkerBuild the fix

Other email spf checks