Your SPF record has a limit of 10 DNS lookups. Here's how to count yours and fix it

If your email lands in spam and your SPF record "looks fine", count its DNS lookups. SPF has a hard limit that many domains cross without noticing, usually after adding a newsletter tool, a help desk and a shop platform over the years.

The rule

When a receiving server checks SPF, it may follow at most 10 mechanisms that need a DNS query (RFC 7208, section 4.6.4). These count:

• include:
• a and mx
• ptr and exists:
• the redirect= modifier

These do not count: ip4:, ip6: and all.

The count includes everything nested: if you include:_spf.google.com and that record includes three more, that is four lookups, not one.

Go over 10 and the receiver stops with a "permerror". SPF then counts as failed for every message, and DMARC has to rely on DKIM alone.

Count yours

Start with your own record:

dig +short TXT example.com | grep spf1

On Windows: nslookup -type=TXT example.com.

Then look up every include: and redirect= target the same way and add up the counting terms you find at each level:

dig +short TXT _spf.google.com
dig +short TXT spf.protection.outlook.com

A common real-world result: Google Workspace (about 4), Microsoft 365 (2), a newsletter tool (1-2), a help desk (1-2), a shop (1-3), plus a and mx at the top. That is 11-14 before anyone notices.

Fix it

1. Remove what you no longer use. Old newsletter tools and trial services are the usual culprits.
2. Drop a and mx unless your web or mail server sends mail itself. Most small businesses send through a provider, so these two lookups do nothing.
3. Move bulk senders to a subdomain. Send newsletters from news.example.com with its own SPF record; it has its own limit of 10.
4. Be careful with "flattening" (replacing includes with the IP addresses they contain). It works until your provider changes its addresses, and then mail fails silently. Prefer the steps above.
5. Keep exactly one SPF record. Two v=spf1 records on the same name are an error by themselves.

Or let a tool count it

I built a free checker that follows the nested includes, counts the lookups and also checks DKIM, DMARC, MTA-STS and DNSSEC: guides.webcareshelf.com/email-check. No signup, and it reads only public DNS.

Disclosure: it's our project. There's an optional $9 report that writes the corrected records for your domain; everything above works without it.