auth.spf.lookup_limit
SPF DNS Lookup Limit Exceeded
What we check
We count the DNS lookups required to fully evaluate the SPF record. The include, a, mx, ptr, and exists mechanisms and the redirect modifier each cause a DNS query; ip4, ip6, and all do not. RFC 7208 §4.6.4 caps evaluation at 10 lookups.
What this finding means
Your SPF record needs more than 10 DNS lookups to evaluate. Once a receiver crosses that limit it stops and returns a PermError — SPF fails permanently, exactly as if the record were invalid.
The count is cumulative across nesting: every include: you list may itself contain further include: mechanisms, and all of them count against the same budget of 10.
Why it matters
- SPF fails outright. Past 10 lookups, receivers return PermError; your legitimate mail no longer passes SPF, and DMARC alignment via SPF is lost with it.
- It creeps up over time. Each new SaaS tool ("add our include to your SPF") spends part of the budget. A record that was fine at five providers quietly breaks at the eleventh lookup.
- Nesting hides the cost. A single
include:can pull in several lookups you never see in your own record.
How to fix
Count the lookups with an SPF flattening/audit tool that expands every nested
include:and shows the running total.Replace includes with direct IP mechanisms where you control static addresses —
ip4:/ip6:cost zero lookups:example.com. IN TXT "v=spf1 ip4:203.0.113.0/24 include:_spf.your-provider.example -all"Drop unused includes. Remove providers you no longer send through — each is at least one lookup back.
Consider SPF flattening as a last resort (resolving includes to literal IP ranges), but only with automation that keeps the flattened list current when providers change IPs.
How it's graded
Exceeding the SPF lookup limit carries a 10-point deduction in the Authentication category. See Grading Methodology for the full scoring model.
Evidence example
$ dig +short TXT example.com
"v=spf1 include:a.example include:b.example include:c.example include:d.example -all"
Expanding nested includes: 11 DNS lookups required (limit 10)
Result: permerror (too many DNS lookups)