SPF is close to the 10 DNS lookup limit
Updated
13% of the 784 domains we could check get a warning for this. Sample: the first 1,000 domains by rank in the Majestic Million, checked on 2026-10-12. How we measured
What this check looks for
Your SPF record still works, but it is close to the maximum number of DNS lookups allowed. Adding one more sending service, or a provider expanding their own record, would break it.
Why it matters
The failure, when it comes, is invisible: nothing in your own systems changes, and mail simply stops passing SPF. Reducing the count now avoids a breakage you would not be watching for.
When the check passes, your report says: “SPF has room to spare under the ten DNS lookup limit”.
What it costs your score
When this check fails it removes 8 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 8 points
- Family cap
- email-auth.spf · 35
- Category
- Email authentication
- Module
- Email spf
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Free up lookup budget before you need it.
A provider expanding their own include can push you over the limit without any change on your side.
Audit the includes and remove services you no longer use.
Consider moving bulk or transactional mail to a subdomain with its own record.
How to confirm it worked
Re-run the SPF checker and confirm the lookup counter is 7 or lower.
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
Evaluating ‹domain› costs ‹lookup count› of the 10 DNS-lookup terms permitted by RFC 7208 §4.6.4. Note that the count is not fully under your control: a provider you include can add lookups to their own record at any time and push you over the limit.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.