auth.spf.void_lookups_exceeded
SPF Void Lookup Limit Exceeded
What we check
We count SPF DNS lookups that return no records — "void" lookups (an NXDOMAIN or a no-data answer). RFC 7208 §4.6.4 limits void lookups to 2; exceeding that causes SPF to fail permanently (PermError).
What this finding means
Your SPF record triggers more than two DNS lookups that resolve to nothing. Each include:, a, mx, exists:, or ptr term that points at a non-existent record is a void lookup, and past two of them receivers return a PermError — SPF stops working entirely.
Void lookups usually mean stale configuration: an include: for a service you've dropped, an a/mx for a hostname that no longer exists, or a typo in a mechanism target.
Why it matters
- SPF fails permanently. A PermError is not a soft warning — your legitimate mail loses its SPF pass, and DMARC alignment via SPF goes with it.
- Points at dead references. Void lookups are a reliable signal that the record references infrastructure that is gone. They rarely appear on a well-maintained record.
- Cheap to fix. Removing dead mechanisms costs nothing and often reclaims lookups against the separate 10-lookup limit too.
How to fix
Find the void terms. An SPF audit tool will flag each
include:/a/mx/exists:that resolves to nothing.Remove or correct them. Delete mechanisms for services you no longer use; fix typos in the ones you do:
example.com. IN TXT "v=spf1 include:_spf.current-provider.example -all"Re-scan to confirm the void count is back under 2.
How it's graded
Exceeding the void-lookup limit carries a 10-point deduction in the Authentication category. See Grading Methodology for the full scoring model.
Evidence example
$ dig +short TXT example.com
"v=spf1 include:old-crm.example include:dead-tool.example a:gone.example.com -all"
Void lookups: 3 (all three targets return NXDOMAIN); RFC 7208 §4.6.4 permits 2
Result: permerror (too many void lookups)