July 10, 2026

SPF's 10-lookup limit: the silent failure mode

SPF records are just a list of who’s allowed to send mail as your domain — but the mechanism for building that list has a hard limit that catches a lot of domains off guard.

Where the lookups come from

Every include:, a, mx, ptr, exists, and redirect mechanism in an SPF record costs one DNS lookup. A record like this looks short:

v=spf1 include:_spf.google.com include:mailgun.org include:sendgrid.net include:_spf.salesforce.com ~all

But each include: points to another SPF record, which can have its own include:s. Google’s alone resolves through several. Add a CRM, a support desk, a marketing platform, and a transactional email service — each contributing its own vendor’s SPF chain — and it’s easy to end up walking past 10 lookups without ever seeing an obviously long record.

What happens at the limit

RFC 7208 caps SPF evaluation at 10 DNS lookups. Past that, the entire check returns PermError — not “some senders fail,” but the whole SPF evaluation is treated as broken, for every sender, on every message. There’s no warning email, no dashboard alert. It shows up only as spf: fail (or PermError) across the board on your next DMARC aggregate report, and by then it’s often been broken for a while.

What to actually do about it

  • Count your include: chains, not just top-level entries. A tool that resolves the full chain (or a manual walk with dig txt) is the only way to know your real number.
  • Flatten where you can. Some SPF records can be reduced to static ip4:/ip6: ranges instead of include:s, trading a bit of maintenance for lookups saved — but this needs revisiting if a vendor changes their sending ranges.
  • Watch DMARC reports for PermError after adding any new sender. This is the fastest way to catch the limit being crossed, since it’s invisible otherwise. See how to read a DMARC aggregate report for what to look for.

This is also a good argument for keeping DMARC in p=none for a while after any SPF change — see the guide — since a broken SPF record is exactly the kind of thing that should surface in reports before it ever affects delivery.