SPF is close to the 10 DNS lookup limit
What this check looks for
Your SPF record still works, but it is close to the maximum number of DNS lookups allowed. Adding one more sending service, or a provider expanding their own record, would break it.
Why it matters
The failure, when it comes, is invisible: nothing in your own systems changes, and mail simply stops passing SPF. Reducing the count now avoids a breakage you would not be watching for.
When the check passes, your report says: “SPF has room to spare under the ten DNS lookup limit”.
What it costs your score
When this check fails it removes 8 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 8 points
- Family cap
- email-auth.spf · 35
- Category
- Email authentication
- Module
- Email spf
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Free up lookup budget before you need it.
A provider expanding their own include can push you over the limit without any change on your side.
Audit the includes and remove services you no longer use.
Consider moving bulk or transactional mail to a subdomain with its own record.
How to confirm it worked
Re-run the SPF checker and confirm the lookup counter is 7 or lower.
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
Evaluating ‹domain› costs ‹lookup count› of the 10 DNS-lookup terms permitted by RFC 7208 §4.6.4. Note that the count is not fully under your control: a provider you include can add lookups to their own record at any time and push you over the limit.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other email spf checks
- SPF authorises the whole internet through an address range
- SPF record lists the same sender twice
- SPF include chain contains a loop
- SPF include target has no SPF record
- More than one SPF record published
- SPF record has no all mechanism
- No SPF record published
- SPF authorises a very large block of addresses
- SPF ends in +all — anyone may send as your domain
- SPF uses the deprecated ptr mechanism
- SPF ends in ?all (neutral)
- SPF has both redirect= and an all mechanism