dotvitals

SPF needs more than 10 DNS lookups

HighConfirmedemail.spf.too-many-lookups

What this check looks for

Evaluating your SPF record requires more DNS lookups than the standard allows. Receiving servers stop early and return an error, so your SPF check does not pass even for mail you actually sent.

Why it matters

This silently breaks authentication for every message. It usually appears after a few marketing or helpdesk tools are added, each contributing its own include.

When the check passes, your report says: “SPF evaluates within the ten DNS lookup limit”.

What it costs your score

When this check fails it removes 20 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.

It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.

Severity
high
Default confidence
confirmed
Status when triggered
fail
Deduction
20 points
Family cap
email-auth.spf · 35
Category
Email authentication
Module
Email spf
Fix owned by
dns host
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Bring the record back under 10 lookups by removing unused senders or splitting by subdomain.

Over the limit, receivers return permerror and SPF stops authenticating anything.

  1. Remove includes for services you no longer send from — this is usually enough on its own.

  2. Replace a provider include with the ip4:/ip6: ranges it publishes, if that provider documents stable ranges. Free, but the ranges go stale.

  3. Move bulk senders to a subdomain (mail.‹domain›) with its own SPF record, which resets the budget.

  4. Flatten only as a last resort, and set a reminder to re-check the flattened ranges.

How to confirm it worked

  • Re-run the SPF checker and confirm the lookup counter shows 10 or fewer.

  • Use "Test again" on this finding.

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

Evaluating ‹domain› costs ‹lookup count› DNS-lookup terms; RFC 7208 §4.6.4 caps them at 10 and requires permerror beyond that. include, a, mx, ptr, exists and redirect each count; ip4, ip6 and all do not. The cost is transitive: an include that itself contains three includes costs four.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email spf checkerBuild the fix

Other email spf checks