---
title: "How to Reduce SPF DNS Lookups (Fix Too Many) | AutoSPF"
description: "Reduce SPF DNS lookups and fix the too many lookups PermError: clean up your record, replace mx/a with ip4, consolidate includes, and flatten to stay under 10."
image: "https://autospf.com/images/og-default.png"
canonical: "https://autospf.com/spf-too-many-dns-lookups/how-to-reduce-spf-lookups/"
---

# How to reduce SPF DNS lookups and fix too many lookups

Reduce SPF DNS lookups by deleting unused senders, replacing mx, a, and ptr mechanisms with explicit ip4/ip6 entries, consolidating includes, and flattening the record so it stays under the RFC 7208 10-lookup limit and avoids PermError.

If your domain returns a `PermError`, the cause is almost always the same: your SPF record forces more than 10 DNS lookups during evaluation. Under [RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208), an SPF check is capped at 10 DNS-querying mechanisms and 2 void lookups — cross either ceiling and authentication fails for every message you send. The fix is to reduce the number of lookups your record triggers, and this guide walks through every reliable way to do that, from quick cleanups to permanent automation.

This is the child page under the pillar guide on [SPF too many DNS lookups](/spf-too-many-dns-lookups/). If you are not yet sure how close you are to the ceiling, start with [the 10-lookup limit explained](/spf-too-many-dns-lookups/10-lookup-limit-explained/) and [how to count your SPF lookups](/spf-too-many-dns-lookups/how-to-count-spf-lookups/), then come back here to bring the number down.

## Which SPF mechanisms cost you a DNS lookup?

Before you can reduce lookups, you need to know what counts. Not every part of an SPF record queries DNS — only these mechanisms and modifiers do, and each one counts against your budget of 10:

- **`include:`** — fetches another domain’s SPF record, then evaluates everything inside it. A single vendor `include:` commonly expands to 3-6 lookups because of nesting.
- **`a`** — resolves A/AAAA records for the domain or a named host. Counts 1+.
- **`mx`** — looks up the domain’s MX records, then resolves each mail host to an IP. Fans out to 2-6 lookups depending on how many MX hosts you run.
- **`ptr`** — reverse-resolves the client IP and forward-confirms it. Slow, brittle, and deprecated. Avoid entirely.
- **`exists`** — evaluates a domain (often via macros) with an A lookup. Counts 1 each.
- **`redirect=`** — fetches another domain’s SPF and continues there; that record’s lookups count toward the same 10.

Mechanisms that cost **zero** lookups are `ip4:`, `ip6:`, and `all`. These match directly against the sending IP with no DNS query, which is exactly why every reduction technique below funnels lookups toward explicit IP entries. The 10-lookup budget applies across the entire evaluation, so nested includes and redirect targets all draw from the same pool.

## Step 1: Audit and clean up your current record

The fastest wins come from deleting things you no longer need. Records accumulate cruft as teams add SaaS tools and abandon old ones without ever pruning the SPF entry. Start by pulling your live record:

```
dig +short TXT yourdomain.com | grep v=spf1
```

Then work through it:

- **Confirm you have exactly one SPF record.** Two `v=spf1` TXT records on the same domain is an instant `PermError` on its own. If you find more than one, [merge them into a single record](/fix-spf-permerror-and-temperror-a-diy-guide/) before doing anything else.
- **Remove dead senders.** If you switched off a marketing platform or CRM last year, its `include:` is still burning lookups. Delete it.
- **Kill `ptr` outright.** It is deprecated, slow, and often ignored by receivers. Replace it with `ip4:`/`ip6:` for the hosts it was covering.
- **Strip duplicate and overlapping entries.** If two includes resolve to the same IP block, keep one. If an `ip4:` range already covers an address listed separately, drop the redundant line.

For a full pruning checklist, the pattern is the same one covered in [how to count your SPF lookups](/spf-too-many-dns-lookups/how-to-count-spf-lookups/) — inventory every mechanism, then decide what actually still sends mail.

## Step 2: Replace lookup-heavy mechanisms with explicit IPs

Once the record is clean, convert the mechanisms that still cost lookups into ones that don’t. This is the core of reducing your count.

Replace `mx` and `a` first. Both fan out unpredictably. If your mail servers have stable addresses, list them as `ip4:` / `ip6:` entries and remove the `mx` and `a` mechanisms entirely:

```
# Before (3-4 lookups)
v=spf1 mx a include:_spf.google.com -all

# After (1 lookup)
v=spf1 ip4:203.0.113.10 ip4:203.0.113.11 include:_spf.google.com -all
```

Then tackle third-party includes. Many vendors — Amazon SES, Mailgun, SendGrid — publish their sending ranges as documented CIDRs. Where a provider’s ranges are stable, replace `include:vendor.com` with the corresponding `ip4:`/`ip6:` entries and include only the regions you actually send from. The caveat: some providers rotate IPs frequently, so a hand-converted range can silently go stale and de-authorize legitimate mail. Keep an `include:` for genuinely high-churn vendors, or automate the refresh (see below).

## Step 3: Consolidate and delegate

If you are still over budget after cleaning and converting, restructure how the record is organized.

**Merge overlapping authorities.** Prioritize your most-used senders as `ip4:`/`ip6:` entries at the front of the record (they cost nothing), then a single consolidated `include:` for your primary platform such as `spf.protection.outlook.com` or `_spf.google.com`.

**Use `redirect=` for shared policies.** If you run several sibling domains with near-identical SPF, point each at one canonical policy with `v=spf1 redirect=_spf.parent.tld`. You maintain one record instead of many, and every child inherits a under-budget policy. Use `redirect=` to eliminate duplicate policy across domains — use `include:` when you need to merge multiple authorities inside one domain’s record.

**Segment senders onto subdomains.** Give each platform its own envelope-sender subdomain (`mg.example.com`, `sg.example.com`), each with its own SPF record. This localizes the lookup cost of a bloated vendor to a subdomain instead of loading it onto your root domain, where it competes with everything else for the 10-lookup budget.

## Step 4: Flatten the record

Flattening is the most thorough reduction technique and a completely valid fix. It resolves every `include:`, `a`, `mx`, and `redirect=` down to the underlying `ip4:`/`ip6:` addresses, collapsing a record that needed 12+ lookups into one that needs zero (or close to it). For the full walkthrough, see [SPF flattening](/spf-flattening/).

The tradeoff is maintenance. A hand-flattened record is a point-in-time snapshot: the moment Google, Microsoft, or SendGrid rotates an IP range, your static record goes stale and starts failing legitimate mail. It also grows long — watch the [255-character-per-string TXT limit](/spf-too-many-dns-lookups/spf-255-character-limit/), splitting into multiple quoted strings when needed. That is why flattening is only durable when something keeps it fresh.

This is where [automatic SPF flattening service](/) earns its place. AutoSPF resolves your includes to exact sending IPs, rescans every 15 minutes, and auto-updates the published record when a vendor’s ranges change — so the record stays flat, accurate, and permanently under the 10-lookup limit without manual busywork. It de-duplicates overlapping CIDRs, splits long TXT strings safely, and rolls back if a change would cause a `PermError`.

## Step 5: Validate and monitor

Never publish a reduced record without confirming it resolves cleanly. Run it through the [SPF Checker](/tools/spf-checker/) to see the exact lookup count and mechanism-by-mechanism expansion. Aim for **6-8 lookups in steady state**, not the full 10 — that headroom absorbs provider-side nesting changes and transient DNS anomalies without tipping you back into `PermError`.

After publishing, allow for DNS propagation (up to a few hours depending on TTL), then re-check. Because vendor IPs and your own sending stack drift over time, reducing lookups once is not a permanent fix on its own — schedule a quarterly review, or let automated monitoring alert you before the count creeps back over the line.

## Frequently Asked Questions

### What is the fastest way to fix too many SPF lookups?

Delete unused senders first — old CRMs, retired marketing tools, and duplicate includes are usually the quickest wins. Then replace `mx`, `a`, and `ptr` mechanisms with explicit `ip4:`/`ip6:` entries. If you are still over 10, flatten the record so every `include:` becomes a static IP.

### Does the `redirect=` modifier count toward the 10-lookup limit?

Yes. `redirect=` triggers at least one DNS query to fetch the target domain’s SPF record, and every lookup inside that redirected record counts toward the same budget of 10\. Use `redirect=` to centralize policy across sibling domains, not as a way to bypass the limit.

### Will flattening my SPF record break when a vendor changes IPs?

It can, if you flatten manually. A static flattened record is a snapshot, and providers like Google and SendGrid rotate their ranges without notice — when they do, a hand-built record silently de-authorizes real mail. Automated flattening with monitoring, such as AutoSPF’s 15-minute rescan and auto-update, rebuilds the record whenever ranges change so it never goes stale.

### How many DNS lookups should my SPF record use?

The hard ceiling is 10, but engineer your record to 6-8 in steady state. That buffer absorbs the extra lookups that appear when a vendor adds nesting to their own include, plus temporary DNS timeouts, without pushing you over into `PermError`.

### Can I just remove `mx` and `a` from my SPF record?

In most cases, yes — and you should if your mail hosts have stable addresses. Replace them with explicit `ip4:`/`ip6:` entries for your actual outbound IPs. `mx` can fan out to many hosts and `a` varies with hostname resolution, so both cost lookups that direct IP entries do not.

### Do `ip4:` and `ip6:` mechanisms count against the limit?

No. `ip4:`, `ip6:`, and `all` match the sending IP directly with no DNS query, so they cost zero lookups. This is exactly why every reduction technique aims to convert lookup-heavy mechanisms into explicit IP entries — you can list dozens of IP ranges without ever touching your budget of 10.

Rated 5/5 on G2 · Trusted since 2018 

##  Trusted by 50,000+ domains 

### "AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product"

> It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF "flattens" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change. 

 PJ 

Peter J.

 President · Small-Business (50 or fewer emp.) 

### "Helped us go beyond capacity"

> AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example. 

 VU 

Verified User

 Financial Services · Mid-Market (51-1000 emp.) 

### "Great service and great support"

> AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup. 

 GF 

Greg F.

 Mid-Market (51-1000 emp.) 

[Read our reviews on G2 ](https://www.g2.com/products/autospf/reviews)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.facebook.com/autospf","https://github.com/duocircle","https://www.g2.com/products/autospf/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"5.0","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/autospf/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM","Email Deliverability","SPF Lookup Limits"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is the fastest way to fix too many SPF lookups?","acceptedAnswer":{"@type":"Answer","text":"Delete unused senders first — old CRMs, retired marketing tools, and duplicate includes are usually the quickest wins. Then replace `mx`, `a`, and `ptr` mechanisms with explicit `ip4:`/`ip6:` entries. If you are still over 10, flatten the record so every `include:` becomes a static IP."}},{"@type":"Question","name":"Does the `redirect=` modifier count toward the 10-lookup limit?","acceptedAnswer":{"@type":"Answer","text":"Yes. `redirect=` triggers at least one DNS query to fetch the target domain's SPF record, and every lookup inside that redirected record counts toward the same budget of 10. Use `redirect=` to centralize policy across sibling domains, not as a way to bypass the limit."}},{"@type":"Question","name":"Will flattening my SPF record break when a vendor changes IPs?","acceptedAnswer":{"@type":"Answer","text":"It can, if you flatten manually. A static flattened record is a snapshot, and providers like Google and SendGrid rotate their ranges without notice — when they do, a hand-built record silently de-authorizes real mail. Automated flattening with monitoring, such as AutoSPF's 15-minute rescan and auto-update, rebuilds the record whenever ranges change so it never goes stale."}},{"@type":"Question","name":"How many DNS lookups should my SPF record use?","acceptedAnswer":{"@type":"Answer","text":"The hard ceiling is 10, but engineer your record to 6-8 in steady state. That buffer absorbs the extra lookups that appear when a vendor adds nesting to their own include, plus temporary DNS timeouts, without pushing you over into `PermError`."}},{"@type":"Question","name":"Can I just remove `mx` and `a` from my SPF record?","acceptedAnswer":{"@type":"Answer","text":"In most cases, yes — and you should if your mail hosts have stable addresses. Replace them with explicit `ip4:`/`ip6:` entries for your actual outbound IPs. `mx` can fan out to many hosts and `a` varies with hostname resolution, so both cost lookups that direct IP entries do not."}},{"@type":"Question","name":"Do `ip4:` and `ip6:` mechanisms count against the limit?","acceptedAnswer":{"@type":"Answer","text":"No. `ip4:`, `ip6:`, and `all` match the sending IP directly with no DNS query, so they cost zero lookups. This is exactly why every reduction technique aims to convert lookup-heavy mechanisms into explicit IP entries — you can list dozens of IP ranges without ever touching your budget of 10."}}]}
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"SPF Too Many DNS Lookups","item":"https://autospf.com/spf-too-many-dns-lookups/"},{"@type":"ListItem","position":3,"name":"Reduce Lookups","item":"https://autospf.com/spf-too-many-dns-lookups/how-to-reduce-spf-lookups/"}]}
```

```json
{"@context":"https://schema.org","@type":"Product","name":"AutoSPF","url":"https://autospf.com","aggregateRating":{"@type":"AggregateRating","ratingValue":5,"reviewCount":21,"bestRating":5,"worstRating":1},"review":[{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Peter J.","jobTitle":"President"},"datePublished":"2026-03-10","reviewBody":"It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF \"flattens\" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change.","name":"AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Verified User","jobTitle":"Financial Services"},"datePublished":"2025-07-31","reviewBody":"AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.","name":"Helped us go beyond capacity","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Greg F."},"datePublished":"2023-07-26","reviewBody":"AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup.","name":"Great service and great support","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}}]}
```