--- title: "SPF Too Many DNS Lookups : What Does it Mean and How to Fix it | AutoSPF" description: "Every time you query your DNS, it costs the validator (the recipient’s email system) resources like bandwidth and CPU memory." image: "https://autospf.com/og/blog/fixing-spf-dns-lookups-quick-tips.png" canonical: "https://autospf.com/blog/fixing-spf-dns-lookups-quick-tips/" --- Quick Answer Every time you query your DNS, it costs the validator (the recipient’s email system) resources like bandwidth and CPU memory. A maximum limit of 10 DNS lookups is imposed to avoid unreasonable load on the validator. If an SPF record exceeds this limit, SPF too many DNS lookups error or technically called the ‘Permerror’ comes up. ## Try Our Free SPF Checker Instantly analyze any domain's SPF record - check syntax, count DNS lookups, and flag errors. [ Check SPF Record → ](/tools/spf-checker/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Ffixing-spf-dns-lookups-quick-tips%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=SPF%20Too%20Many%20DNS%20Lookups%20%3A%20What%20Does%20it%20Mean%20and%20How%20to%20Fix%20it&url=https%3A%2F%2Fautospf.com%2Fblog%2Ffixing-spf-dns-lookups-quick-tips%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Ffixing-spf-dns-lookups-quick-tips%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Ffixing-spf-dns-lookups-quick-tips%2F&title=SPF%20Too%20Many%20DNS%20Lookups%20%3A%20What%20Does%20it%20Mean%20and%20How%20to%20Fix%20it "Share on Reddit") [ ](mailto:?subject=SPF%20Too%20Many%20DNS%20Lookups%20%3A%20What%20Does%20it%20Mean%20and%20How%20to%20Fix%20it&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Ffixing-spf-dns-lookups-quick-tips%2F "Share via Email") ![DNS Lookups](https://media.mailhop.org/autospf/images/2023/06/spf-validator-1712.jpg) Every time you query your DNS, it costs the validator (the recipient’s email system) resources like bandwidth and CPU memory. A maximum limit of 10 DNS lookups is imposed to avoid unreasonable load on the validator. If an SPF record exceeds this limit, SPF too many DNS lookups error or technically called the ‘Permerror’ comes up. > “From an engineering perspective, the 10-lookup limit is a resource protection mechanism, not a security feature,” says Adam Lundrigan, CTO of DuoCircle. “RFC 7208 caps lookups to prevent SPF evaluation from becoming a DNS amplification vector. But the practical effect is that any enterprise using more than 3-4 email services hits the wall. The fix is either flattening - which trades lookup count for record length - or macros, which delegate resolution entirely.” > “The 10-lookup limit is the single most common reason enterprise SPF records silently break,” says Brad Slavin, General Manager of DuoCircle and founder of AutoSPF. “In our experience managing SPF for 2,000+ customer domains, the failure mode is always the same: a team adds a new SaaS tool, its include pushes the total past 10, and legitimate email starts failing - but nobody notices until a customer complains about missing invoices or password resets.” _Per [RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208), SPF evaluation is capped at 10 DNS mechanism lookups and 2 void lookups per check - exceeding either limit produces a `PermError` that fails authentication for every message from the domain._ For a complete walkthrough of every SPF error type, see our [SPF Errors and Troubleshooting Guide](/blog/spf-errors-troubleshooting-guide/). ## Causes of SPF Too Many DNS Lookup Errors Domain administrators or owners come across the SPF permerror too many DNS lookups issue due to the reckless use of the ‘_include’_ or the ‘_redirect’_ modifiers. This even results in a deteriorated [email deliverability rate](https://sendpulse.com/support/glossary/delivery-rate#:~:text=Email%20delivery%20rates%20are%20calculated,some%20emails%20may%20have%20bounced.) which hampers PR, marketing, and other email-based campaigns. ## What Happens if SPF Record DNS Lookup Limit is Exceeded? When the SPF too many DNS lookup limit is reached, emails sent from that domain don’t reach the desired recipients’ inboxes. Gmail sends such emails to the spam folder, and Microsoft Office 365 blocks these domains automatically if they fail SPF authentication. ![Spf validator](https://media.mailhop.org/autospf/images/2023/06/spf-validator-1713.jpg) ## How to Fix SPF Too Many DNS Lookups? ### Use ip4 and ip6 The ip4 and ip6 mechanisms list a static IP range in the SPF record. They reduce the _include_ statements as well. ### Remove ptr and mx Mechanisms Using ptr and mx mechanisms require more [DNS lookups](https://constellix.com/news/how-does-dns-lookup-work) which causes reaching the limit quickly. ### Remove include Statements The _include_ statement allows third-party vendors to send emails using your domain. You should remove _include_ statements that direct SPF checks to senders who don’t send emails on your behalf anymore. This reduces the likelihood of getting SPF too many DNS lookups issue. ![Spf validator](https://media.mailhop.org/autospf/images/2023/06/spf-validator-1714.jpg) ### SPF Flattening AutoSPF’s automatic SPF flattening service replaces all the domains in an [SPF record](https://www.techtarget.com/searchsecurity/tip/How-SPF-records-prevent-email-spoofing-phishing-and-spam) with their IP addresses so that you don’t have to perform SPF DNS lookups. However, manual SPF flattening requires constant monitoring and proper configurations, which is difficult to come by. That’s why we at AutoSPF offer an SPF flattening and notification services for your email-sending domain so that you never face SPF errors for too many DNS lookups. ![Adam Lundrigan](https://media.mailhop.org/autospf/images/authors/adam-lundrigan.jpg) [ Adam Lundrigan ](/authors/adam-lundrigan/) CTO CTO of DuoCircle. Architect of AutoSPF's SPF flattening engine and DNS monitoring infrastructure. [LinkedIn Profile →](https://www.linkedin.com/in/adamlundrigan/) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) ## Related Articles [ Foundational 17m 10 Reasons The SPF Standard Is Essential For Protecting Your Domain Nov 20, 2025 ](/blog/10-reasons-the-spf-standard-is-essential-for-protecting-your-domain/)[ Foundational 5m 4 ChatGPT and AI-based scams to be wary of in the second half of 2024 Aug 16, 2024 ](/blog/4-ai-and-chatgpt-scams-to-watch-for-in-2024/)[ Foundational 6m 6 Steps to Outplay BEC Attackers Feb 2, 2024 ](/blog/6-steps-to-outplay-bec-attackers/)[ Foundational 4m 7 Myths and Misconceptions about Sender Policy Framework May 31, 2024 ](/blog/7-myths-and-misconceptions-about-sender-policy-framework/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"SPF Too Many DNS Lookups : What Does it Mean and How to Fix it","description":"Every time you query your DNS, it costs the validator (the recipient’s email system) resources like bandwidth and CPU memory.","url":"https://autospf.com/blog/fixing-spf-dns-lookups-quick-tips/","datePublished":"2023-06-07T18:50:38.000Z","dateModified":"2026-04-18T02:36:41.000Z","dateCreated":"2023-06-07T18:50:38.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/adam-lundrigan/#person","name":"Adam Lundrigan","url":"https://autospf.com/authors/adam-lundrigan/","jobTitle":"CTO","description":"Adam Lundrigan is the Chief Technology Officer of DuoCircle, where he leads engineering and is responsible for the architecture of AutoSPF's SPF flattening engine and DNS monitoring infrastructure. His technical focus is the DNS-level behavior of SPF evaluation, the recursive include resolution logic that underpins flattening, and the monitoring systems that keep customer SPF records healthy as their upstream vendors change IP ranges.","image":"https://media.mailhop.org/autospf/images/authors/adam-lundrigan.jpg","knowsAbout":["SPF Flattening","DNS Architecture","Recursive Include Resolution","SaaS Engineering","DNS Monitoring","Infrastructure Automation"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/adamlundrigan/"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/fixing-spf-dns-lookups-quick-tips/"},"articleSection":"foundational","keywords":"","wordCount":331,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/images/2023/06/spf-validator-1712.jpg","caption":"DNS Lookups","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Foundational","item":"https://autospf.com/foundational/"},{"@type":"ListItem","position":4,"name":"SPF Too Many DNS Lookups : What Does it Mean and How to Fix it","item":"https://autospf.com/blog/fixing-spf-dns-lookups-quick-tips/"}]} ```