SPF fix

How to Fix SPF PermError: Too Many DNS Lookups

This guide helps you fix SPF PermError from too many DNS hops: count lookups, then flatten or trim until you’re under the limit.

Why you hit the wall

Receivers walk your SPF tree and stop at 10 DNS lookups — include:, a:, mx:, nested stuff all counts. Blow past 10 and they throw PermError and may fail you. RFC 7208 is strict here. Peek at SPF record if you want the full picture.

Count lookups before you panic-edit

Open DNS Preflight. Expand the SPF tree — it shows who ate each hop and the running total.

Flatten when you’re over budget

Swap fat includes for literal IPs when you must. Example:

Before: v=spf1 include:sendgrid.net include:_spf.google.com ~all After: v=spf1 ip4:167.89.0.0/17 ip4:74.125.0.0/16 ~all

Heads up: IPs drift. You’ll touch DNS again when SendGrid or Google reshuffles ranges — or drop a vendor and stay under 10 without flattening.

Step-by-step fix

Step 1 Run DNS Preflight and expand the SPF lookup tree to see your current count

Step 2 Identify which includes are consuming the most lookups

Step 3 For high-lookup providers, fetch their current IP ranges from their documentation

Step 4 Replace include: with ip4: and ip6: entries for those providers

Step 5 Verify your new record stays under 10 lookups using DNS Preflight

Step 6 Publish the updated TXT record and re-run DNS Preflight to confirm

Count SPF lookups in your browser

Open DNS Preflight →

Related glossary: SPF record · DMARC · DMARC alignment

FAQ

What is SPF PermError?

Your record is broken or too chatty — receivers bail with PermError and often treat it like a hard fail.

How do I count my SPF lookups?

Use our SPF tree in DNS Preflight — it walks includes recursively and prints the total at the bottom.

What is SPF flattening?

You paste real IPs instead of include: chains so those hops cost zero lookups — you babysit the list when vendors move subnets.

Which mechanisms count toward the 10-lookup limit?

include:, a:, mx:, ptr:, exists:, and redirect= each burn one lookup. ip4:, ip6:, and all are free.

What happens if I exceed 10 SPF lookups?

PermError. Inboxes may junk or drop mail depending on DMARC and how cranky the receiver feels.

← All SPF fix guides

Open DNS Preflight and re-check your zone →