SPF exceeds the void DNS lookup limit
What this check looks for
Too many of the lookups in your SPF record point at names that do not exist. Receivers stop evaluating and return an error, so the record authenticates nothing.
Why it matters
This is usually the fingerprint of a decommissioned service left in the record. It breaks authentication for everything else in the record too.
When the check passes, your report says: “SPF stays within the void DNS lookup limit”.
What it costs your score
When this check fails it removes 10 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 10 points
- Family cap
- email-auth.spf · 35
- Category
- Email authentication
- Module
- Email spf
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Remove the mechanisms whose target names no longer exist.
More than two void lookups yields permerror, which disables the whole record.
Check each
include:,a:andmx:target for an NXDOMAIN answer.Delete the mechanisms for services you no longer use.
How to confirm it worked
Re-run the SPF checker — the void lookup count must be 2 or fewer.
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
Evaluating ‹domain› produced ‹void lookups› void lookups (NXDOMAIN or an empty answer). RFC 7208 §4.6.4 limits these to two and requires permerror beyond that, specifically to stop SPF records being used to amplify DNS traffic.
Standards and references
- RFC 7208 §4.6.4 — Void Lookups § 4.6.4
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other email spf checks
- SPF authorises the whole internet through an address range
- SPF record lists the same sender twice
- SPF include chain contains a loop
- SPF include target has no SPF record
- SPF is close to the 10 DNS lookup limit
- More than one SPF record published
- SPF record has no all mechanism
- No SPF record published
- SPF authorises a very large block of addresses
- SPF ends in +all — anyone may send as your domain
- SPF uses the deprecated ptr mechanism
- SPF ends in ?all (neutral)