auth.spf.void_lookups_exceeded

SPF Void Lookup Limit Exceeded

What we check

We count SPF DNS lookups that return no records — "void" lookups (an NXDOMAIN or a no-data answer). RFC 7208 §4.6.4 limits void lookups to 2; exceeding that causes SPF to fail permanently (PermError).

What this finding means

Your SPF record triggers more than two DNS lookups that resolve to nothing. Each include:, a, mx, exists:, or ptr term that points at a non-existent record is a void lookup, and past two of them receivers return a PermError — SPF stops working entirely.

Void lookups usually mean stale configuration: an include: for a service you've dropped, an a/mx for a hostname that no longer exists, or a typo in a mechanism target.

Why it matters

How to fix

  1. Find the void terms. An SPF audit tool will flag each include:/a/mx/exists: that resolves to nothing.

  2. Remove or correct them. Delete mechanisms for services you no longer use; fix typos in the ones you do:

    example.com.  IN  TXT  "v=spf1 include:_spf.current-provider.example -all"
    
  3. Re-scan to confirm the void count is back under 2.

How it's graded

Exceeding the void-lookup limit carries a 10-point deduction in the Authentication category. See Grading Methodology for the full scoring model.

Evidence example

$ dig +short TXT example.com
"v=spf1 include:old-crm.example include:dead-tool.example a:gone.example.com -all"

Void lookups: 3 (all three targets return NXDOMAIN); RFC 7208 §4.6.4 permits 2
Result: permerror (too many void lookups)

References