Troubleshooting "SPF PermError: Too Many DNS Lookups": The Complete Fix Guide
What is the SPF 10-DNS-Lookup Limit?
Under RFC 7208, an email receiver evaluating an SPF (Sender Policy Framework) record must limit the number of mechanisms and modifiers that require a DNS query to at most 10
In practice, a PermError means your SPF record is treated as invalid. Major mail providers like Google, Microsoft 365, and Yahoo may reject your emails or route them directly to the spam folder.
Which Mechanisms Count Toward the Limit?
Only mechanisms that trigger recursive DNS queries count toward the 10-lookup limit:
The problem escalates rapidly because `include:` statements are recursive. If you include Google Workspace (`_spf.google.com`), SendGrid (`sendgrid.net`), and Zendesk (`mail.zendesk.com`), each of those third-party records contains its own nested `include:` or `a` mechanisms that consume your 10 lookups.
How to Fix an SPF PermError
1. Eliminate Deprecated Mechanisms
Remove unnecessary `mx` and `ptr` mechanisms. If your outbound mail is handled by third-party SaaS rather than your MX servers, having `mx` in your SPF record wastes lookup cycles. Never use `ptr` as it is officially deprecated in RFC 7208.
2. Consolidate & Remove Stale Services
Audit every service in your SPF record. Companies frequently change CRM or email marketing vendors without removing the old vendor's include statement.
3. Replace Includes with Direct CIDR IP Blocks (SPF Flattening)
Where practical, replace nested domain lookups with specific `ip4:` and `ip6:` ranges. Because IP mechanisms require no DNS queries, they count as 0 lookups against the limit.
4. Segment Subdomains for Different Sending Services
Instead of packing marketing, transactional, and internal corporate email senders into a single apex domain SPF record, delegate dedicated subdomains:
Each subdomain gets its own independent 10-lookup budget, ensuring clean separation and zero risk of PermErrors.
Validate your SPF record and test lookup counts today using the DomainAuditHQ SPF Generator.