Solving the 'Too Many DNS Lookup' Error

An SPF record can encounter different types of errors, causing it to become invalid and incapable of offering protection against phishing and spoofing email messages. These errors arise due to exceeding the character length limit, incorrect use of syntax, misconfigurations, etc. Once the error is resolved, the instances of false positives and protocol breakage stop occurring.

“From an engineering perspective, the 10-lookup limit is a resource protection mechanism, not a security feature,” says Adam Lundrigan, CTO of DuoCircle. “RFC 7208 caps lookups to prevent SPF evaluation from becoming a DNS amplification vector. But the practical effect is that any enterprise using more than 3-4 email services hits the wall. The fix is either flattening — which trades lookup count for record length — or macros, which delegate resolution entirely.”

This guide discusses why the ‘Too many DNS Lookup’ error arises and how you can resolve it.                      

What is an SPF Permerror?

SPF Permerror is short for SPF Permanent error, which is encountered by receiving mail servers while performing authentication checks on incoming messages. It arises due to failure in resolving the issue even after multiple DNS lookups. Running into an SPF Permerror indicates the existence of a fundamental issue in an SPF record, which halts the authentication process.

As per RFC7208, there is a limit of a maximum of 10 DNS lookups to prevent overload on the resources involved in the authentication process. So, when this limit is exceeded, the SPF record encounters an SPF Permerror, causing all messages to either get placed in the spam folder or get rejected, irrespective of their legitimate or illegitimate nature. In simple words, no authentication check happens, and recipients’ servers treat all messages the same. 

Are SPF Fail and SPF Permerror the Same?

No, these are different. SPF fail means that the sending source is not officially authorized to send emails on behalf of the domain owner or their business. This happens when the sending source isn’t listed in the SPF record corresponding to that domain, but someone still sends a message from it.

On the other hand, SPF Permerror is a fundamental issue in an SPF record, which prevents it from functioning properly.

What is the ‘Too Many DNS Lookup’ Error?

As explained above, there is a limit on the maximum number of DNS lookups, and reaching this limit results in the ‘Too many DNS lookup’ error. This limitation is imposed to prevent excessive DNS queries that could trigger performance issues in transit and during delivery. Another important reason to limit the number of DNS lookups is to prevent DDoS or Distributed Denial of Service attacks. 

Here are the primary reasons why this limit is exceeded:

Complicated SPF Records

If an SPF record involves multiple mechanisms, ‘include’ statements, or redirects to other domains, it can result in a chain of DNS lookups, with each of them consuming resources and counting towards the limit.

Moreover, if ‘include’ and ‘redirect’ mechanisms are nested or used in a way that triggers recursive DNS lookups, it can contribute to the lookup limit being reached.

Third-Party Validation

Third parties that frequently change the content of their SPF records cause extra DNS lookups. 

Too Many ‘include’ Statements

Including multiple SPF records from numerous domains using the “include” mechanism can lead to a build-up of DNS lookups. If a domain’s SPF record includes several other domains, it could quickly reach or exceed the allowed lookup limit.

What Is the Impact of Encountering a ‘Too Many DNS Lookup’ Error?

Companies with intricate email infrastructure reach the lookup limit quickly, which causes the following issues:

Delayed Delivery of Messages

Exceeding the lookup limit makes retrieving the SPF record and completing the authentication process time-consuming. This causes a delay in the delivery of messages because the recipient’s server keeps waiting for the responses from multiple DNS servers.

Timeout Errors

The delayed communication between the receiving server and DNS servers triggers timeout errors, causing SPF validation errors or prolonged delivery times.

Incomplete SPF Evaluation

There is a high possibility of premature termination of the SPF evaluation process if there is no response from the DNS servers.

How to Solve the ‘Too Many DNS Lookup’ Error?

To prevent experiencing any of the above undesirable consequences, consider resolving the SPF Permerror by taking these steps-

Limit ‘include’ Statements

An ‘include’ statement is added to redirect the authentication process to another domain’s SPF record to include all the sending sources the company trusts and permits to be used for sending messages. However, the inclusion of unnecessary ‘include’ statements causes more DNS lookups. So, instead of them, start using appropriate mechanisms to stay within the lookup limit. 

It’s suggested to replace ‘include’ statements with ipv4 and ipv6 mechanisms to cover multiple IP addresses under a single ‘include’ statement.

Eliminate Redundant Mechanisms

Take care of repetitive and unnecessary mechanisms. This mistake commonly happens while merging multiple SPF records into one. 

Remove ‘ptr’ Mechanisms

The ‘ptr’ (Pointer) mechanism is generally discouraged in SPF records due to its limited effectiveness and potential for unintended consequences. The ‘ptr’ mechanism relies on reverse DNS lookups to verify that the connecting IP address has a valid reverse DNS entry matching the domain in the SPF record. 

However, this method is not entirely reliable as some legitimate mail servers may not have a consistent or properly configured reverse DNS. Additionally, relying solely on the ‘ptr’ mechanism can introduce delays in email delivery and may lead to false positives, which would block legitimate emails. 

SPF records are more effectively configured using mechanisms like “a,” “mx,” or “include” to specify authorized sending hosts, providing a more robust and reliable approach to email authentication.

SPF Record Flattening

SPF flattening involves consolidating multiple SPF records into a single record, reducing the risk of encountering DNS lookup limits imposed by some receivers. This practice streamlines the authentication process, making it more efficient and less prone to errors.

Conclusion

Fixing the ‘Too many DNS lookup’ error is necessary to ensure receiving servers are able to filter out illegitimate messages from legitimate ones. Moreover, a non-erroneous SPF record improves email deliverability and communication across levels.

You can resolve this by eliminating the unwanted ‘include’ statements and ptr mechanisms. Domain owners who still face a challenge should opt for our automatic SPF flattening services. We streamline your SPF record management, enable DMARC compliance, and improve your email deliverability by fixing the SPF 10 record limitation. All it takes is 60 seconds. So, should we get started?