SPF PermError: Too Many DNS Lookups, and How to Fix It

Your SPF record has a hard limit of 10 DNS lookups. If checking it takes more than that, the result is a permerror, and most receivers then treat the domain as having no valid SPF. The fix is to cut the lookups under 10: remove vendors you no longer send from, swap lookups for fixed IP addresses where you control the server, and move different senders onto different subdomains.

What counts towards the 10

RFC 7208 counts every term that makes the receiver ask DNS another question: include, a, mx, ptr and exists, plus the redirect modifier. Terms that carry an address, ip4 and ip6, cost nothing, and neither does all. The count is recursive. One include that pulls in three more includes costs four.

The standard also tells receivers to stop after two lookups that return nothing (void lookups). An include for a vendor whose DNS no longer exists can therefore break the record even when you are under 10.

How to count your own lookups

1. Read your record with a DNS lookup tool, or paste the domain into the free SPF checker. Warmerly's checker resolves every include and redirect and reports the total, so you do not add up nested includes by hand.
2. Look at the number. 10 or fewer is valid. 11 or more is a permerror.
3. List every include and write down which sender it belongs to. Most records grow one tool at a time and nobody removes the old ones.

How to get under 10

1. Delete senders you no longer use. A newsletter tool you cancelled last year is often still in the record.
2. Remove ptr, and replace a and mx with ip4 or ip6 if the address is fixed and you control it.
3. Check for two SPF records. A domain may publish only one SPF record. Two records is its own permerror, and the cure is to merge them into one line, not to keep both.
4. Give each sender its own subdomain. Send marketing from a subdomain with one record and cold outreach from a separate domain with another. Each name gets its own budget of 10.
5. Check every ip4 and ip6 term is a real address. An IPv6 address pasted after ip4: looks fine to a person and voids the whole record. Warmerly's checker flags these.

Should you flatten the record?

Flattening replaces includes with the IP addresses inside them, so the lookup count drops to nearly zero. It works on the day you do it. The risk is that vendors change their sending addresses, and your flattened copy does not follow. When that happens, real mail from that vendor starts failing SPF and nothing tells you. Flatten only with a service or script that refreshes the record automatically, and treat a hand-flattened record as something to re-check every month.

Does a permerror stop your mail from arriving?

Not by itself. DMARC passes if either SPF or DKIM passes and aligns with your From domain. So a permerror on SPF with working, aligned DKIM often still passes DMARC. Do not rely on that, though. A broken SPF removes one of your two checks, and some receivers weigh SPF failures on their own.