auth.spf.lookup_error
SPF DNS Lookup Failed
What we check
We query the apex SPF TXT record and any include: or redirect= targets. This finding is emitted when a DNS lookup failed temporarily — a timeout or server error — rather than returning a definitive answer.
What this finding means
An SPF DNS lookup did not complete, so the policy result is indeterminate. This is not a statement about your record's correctness — it's an operational hiccup, at your DNS servers or a referenced domain's, that prevented a clean evaluation during this scan.
In live mail flow, a temporary SPF failure produces a TempError, which receivers typically retry rather than treat as a hard fail.
Why it matters
- Usually transient. A single timeout often clears on its own. If it recurs, it points at DNS reliability — an overloaded authoritative server, rate limiting, or a flaky referenced domain.
- Can delay mail. Persistent TempErrors make receivers defer messages while they retry, which slows delivery even though nothing is permanently broken.
- Not a scored fault. Because it's an availability issue rather than a policy defect, it doesn't count against your grade.
How to fix
Re-scan. A one-off timeout will usually not reproduce.
If it persists, check DNS availability for your domain and for every
include:/redirect=target — confirm the authoritative servers answer reliably and aren't rate-limiting queries:dig +short TXT example.com dig +short TXT _spf.your-provider.example
How it's graded
An SPF lookup failure is a warning and carries no point deduction — the result is indeterminate, not a policy defect. See Grading Methodology for the full scoring model.
Evidence example
$ dig +short TXT example.com
"v=spf1 include:_spf.your-provider.example -all"
Evaluating include:_spf.your-provider.example → DNS query timed out
Result: temperror (transient DNS failure)