Inbox check guide
SPF PermError: too many DNS lookups — why it happens and how to fix it
Reviewed
Short answer
SPF records may trigger at most 10 DNS lookups while being evaluated. Each include, a, mx, ptr, exists and redirect counts, and so do the lookups inside every service you include. Above 10, the check returns PermError and inboxes treat your SPF as failed. Remove services that no longer send for you, move bulk senders to a subdomain, and avoid ptr.
Check your domain now
Where the limit comes from
RFC 7208 caps the mechanisms that need a DNS query at 10 per evaluation, so one email can’t make a receiving server perform an unbounded number of lookups. The limit includes nested lookups: include:_spf.google.com alone uses several.
Plain ip4 and ip6 entries and the final all don’t count. The inbox check counts the real total for your domain, following every include.
Fixes, in order of safety
- Remove includes for services you no longer use — old newsletter tools, a previous host, a CRM trial.
- Move high-volume senders to a subdomain (for example news.yourdomain.com) with its own SPF record; it has its own budget of 10.
- Remove ptr (deprecated) and replace a or mx with explicit ip4 entries where the addresses are stable.
- Be careful with “SPF flattening” (replacing includes with IP lists): it works until a provider changes its addresses, then mail fails silently. Prefer a service that updates the flattened list for you, or don’t flatten.
Keep one record
A domain must have exactly one TXT record starting with v=spf1. Two records are a PermError of their own, however short each one is. Merge them into one.