Domain Audit HQ
← Back to Free Tools
RFC 7208 10-LOOKUP CEILING ANALYZER • PERMERROR FLATTENER

SPF Lookup Calculator & Flattener

Recursively count DNS queries across all nested include: mechanisms, diagnose "PermError: too many DNS lookups", and flatten your record to zero lookups.

SPF 10-Lookup Limit Calculator & PermError Flattener

Inspect nested include: mechanisms, measure real-time RFC 7208 lookup quotas, and generate flattened zero-lookup records.

Option A: Live Domain DNS Lookup

Fetch and audit the published SPF TXT record directly from global DNS.

Option B: Paste SPF String for Syntax Simulation

Test a draft SPF record before publishing to avoid production email outages.

How the SPF 10-DNS-Lookup Limit Works & DNS Mechanics

Whenever an email receiver evaluates an SPF record, each mechanism that triggers an external DNS query counts toward a strict RFC 7208 budget of 10 lookups. Crucially, nested include: statements inherit the lookups of their children.

Mechanisms That Consume Lookups (+1 Each)

  • include:<domain> (1 query + all nested queries within that domain)
  • a or a:<domain> (1 query for A/AAAA address)
  • mx or mx:<domain> (1 query for MX host + IP lookup)
  • ptr or ptr:<domain> (Deprecated, triggers reverse DNS query)
  • exists:<domain> (1 query testing host existence)
  • redirect=<domain> (1 query replacing existing record)

Mechanisms That Are Free (0 Lookups)

  • ip4:<ip-or-cidr> (Evaluated locally in memory, 0 DNS lookups)
  • ip6:<ip-or-cidr> (Evaluated locally in memory, 0 DNS lookups)
  • all (Terminal policy evaluation, 0 DNS lookups)
  • v=spf1 (Header tag, 0 DNS lookups)

Step-by-Step Guide: How to Fix "PermError: Too Many DNS Lookups"

Step 1: Audit and Remove Deprecated Services

Audit every include: in your current record. Often, legacy services (old Zendesk instances, retired email marketing tools, or previous agency platforms) remain in DNS years after cancellation. Removing just 1 or 2 unused services frequently brings domains back under the 10-lookup threshold.

Step 2: Replace "mx" and "a" with Direct IP Subnets

If your web server or mail server IP is static, delete a and mx from your SPF string and replace them with explicit ip4:198.51.100.1 entries. This frees up 2 precious DNS lookups immediately.

Step 3: Flatten or Delegate to Dedicated Subdomains

For high-volume senders using 5+ marketing and CRM platforms simultaneously, separate sending traffic by subdomain (e.g. marketing.client.com for Mailchimp, billing.client.com for Stripe). Subdomains have independent 10-lookup limits, isolating deliverability risk.

Common SPF Lookup Errors & Delivery Impacts

1. PermError: Maximum DNS-Interactive Terms Limit Exceeded

Impact: Receiving mail systems terminate processing immediately. Under DMARC p=reject, emails from your CEO, sales team, and invoices are dropped silently or returned to sender.

Remediation: Use the interactive flattener above to compress your SPF record into direct CIDR ranges.

2. Void Lookup Limit Reached (>2 Void Lookups)

Impact: If your SPF record points to an include domain that has expired or has a typo, two such queries result in an immediate PermError even if total lookups are below 10.

Remediation: Verify that every domain listed in an include: directive has a live, resolvable TXT record.

Frequently Asked Questions About the SPF 10-Lookup Limit

Answers to technical queries on DNS quotas, flattener mechanics, and RFC 7208 compliance.

Why does the RFC 7208 10-lookup limit exist?+
The 10-DNS-lookup limit was introduced in RFC 7208 section 4.6.4 to defend DNS recursors against distributed denial of service (DDoS) and infinite loop attacks. Without a hard ceiling, an attacker could create malicious SPF chains that force email servers to execute hundreds of DNS requests per incoming message.
Which SPF mechanisms count toward the 10-lookup limit?+
The mechanisms that trigger DNS queries and count toward the limit are: "include:", "a", "mx", "ptr", "exists:", and "redirect=". Conversely, "ip4:", "ip6:", and "all" mechanisms require zero DNS queries and do not count against the 10-lookup quota.
What is SPF record flattening, and how does it fix PermErrors?+
SPF flattening resolves all external "include:" domain names into their underlying static IPv4 and IPv6 address ranges (CIDRs) and replaces the includes with "ip4:" and "ip6:" directives. Because IP mechanisms consume zero DNS lookups, flattening drops your lookup count from 10+ down to zero, instantly resolving PermErrors.
What is the risk of manual SPF flattening?+
Major cloud email providers (Google Workspace, Microsoft 365, Mailgun) regularly expand or rotate their IP address ranges. If you manually flatten an include: into static IPs without continuous monitoring, outgoing emails may eventually originate from newly provisioned provider IPs not present in your static list, causing delivery failures.
Does the "void lookup" limit affect SPF validation?+
Yes. RFC 7208 section 4.6.4 also enforces a strict void lookup limit of 2. If an SPF record contains mechanisms that resolve to NXDOMAIN (non-existent domain) or empty DNS response answers twice during evaluation, the receiving server will immediately abort and return a PermError.

Complementary Domain & Email Authentication Tools

Strengthen your client email infrastructure and DNS security perimeter with our free web tools.

🛡️

SPF Record Generator

Generate RFC 7208 compliant SPF TXT records with instant syntax validation.

Open Tool →
🎨

BIMI Checker & VMC Validator

Audit BIMI records, preview SVG logos, and check VMC certificate readiness.

Open Tool →
✉️

DMARC Policy Generator

Build custom p=reject or p=quarantine policies with aggregate reporting.

Open Tool →
🔑

DKIM Record Builder

Format cryptographic public key TXT records and selectors for email signing.

Open Tool →