SPF needs more than 10 DNS lookups
What this check looks for
Evaluating your SPF record requires more DNS lookups than the standard allows. Receiving servers stop early and return an error, so your SPF check does not pass even for mail you actually sent.
Why it matters
This silently breaks authentication for every message. It usually appears after a few marketing or helpdesk tools are added, each contributing its own include.
When the check passes, your report says: “SPF evaluates within the ten DNS lookup limit”.
What it costs your score
When this check fails it removes 20 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 20 points
- Family cap
- email-auth.spf · 35
- Category
- Email authentication
- Module
- Email spf
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Bring the record back under 10 lookups by removing unused senders or splitting by subdomain.
Over the limit, receivers return permerror and SPF stops authenticating anything.
Remove includes for services you no longer send from — this is usually enough on its own.
Replace a provider include with the
ip4:/ip6:ranges it publishes, if that provider documents stable ranges. Free, but the ranges go stale.Move bulk senders to a subdomain (
mail.‹domain›) with its own SPF record, which resets the budget.Flatten only as a last resort, and set a reminder to re-check the flattened ranges.
How to confirm it worked
Re-run the SPF checker and confirm the lookup counter shows 10 or fewer.
Use "Test again" on this finding.
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
Evaluating ‹domain› costs ‹lookup count› DNS-lookup terms; RFC 7208 §4.6.4 caps them at 10 and requires permerror beyond that. include, a, mx, ptr, exists and redirect each count; ip4, ip6 and all do not. The cost is transitive: an include that itself contains three includes costs four.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other email spf checks
- SPF authorises the whole internet through an address range
- SPF record lists the same sender twice
- SPF include chain contains a loop
- SPF include target has no SPF record
- SPF is close to the 10 DNS lookup limit
- More than one SPF record published
- SPF record has no all mechanism
- No SPF record published
- SPF authorises a very large block of addresses
- SPF ends in +all — anyone may send as your domain
- SPF uses the deprecated ptr mechanism
- SPF ends in ?all (neutral)