dotvitals

SPF exceeds the void DNS lookup limit

MediumConfirmedQuick winemail.spf.void-lookups-exceeded

What this check looks for

Too many of the lookups in your SPF record point at names that do not exist. Receivers stop evaluating and return an error, so the record authenticates nothing.

Why it matters

This is usually the fingerprint of a decommissioned service left in the record. It breaks authentication for everything else in the record too.

When the check passes, your report says: “SPF stays within the void DNS lookup limit”.

What it costs your score

When this check fails it removes 10 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.

It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.

Severity
medium
Default confidence
confirmed
Status when triggered
fail
Deduction
10 points
Family cap
email-auth.spf · 35
Category
Email authentication
Module
Email spf
Fix owned by
dns host
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Remove the mechanisms whose target names no longer exist.

More than two void lookups yields permerror, which disables the whole record.

  1. Check each include:, a: and mx: target for an NXDOMAIN answer.

  2. Delete the mechanisms for services you no longer use.

How to confirm it worked

  • Re-run the SPF checker — the void lookup count must be 2 or fewer.

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

Evaluating ‹domain› produced ‹void lookups› void lookups (NXDOMAIN or an empty answer). RFC 7208 §4.6.4 limits these to two and requires permerror beyond that, specifically to stop SPF records being used to amplify DNS traffic.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email spf checkerBuild the fix

Other email spf checks