Fixing "SPF too many DNS lookups"

If a mail receiver reports SPF permerror, too many DNS lookups, or SPF PermError: Too many DNS lookups (limit 10), your SPF record has crossed the RFC 7208 limit. The effect is not partial: the whole record is treated as an error and, under DMARC, your mail then depends entirely on DKIM.

How lookups are counted

Each of these mechanisms costs one lookup, and includes are counted recursively: include, a, mx, ptr, exists, and the redirect modifier. ip4, ip6 and all are free. A typical vendor include is not one lookup: include:_spf.google.com costs 4 (it includes three netblock records), include:spf.protection.outlook.com costs 2 to 3, include:servers.mcsv.net (Mailchimp) costs 1.

Five fixes, in order of preference

1. Remove what you no longer use. Most records over the limit include a tool that was cancelled two years ago. Check each include against your current vendor list.
2. Move bulk senders to a subdomain. Send marketing from news.yourdomain.com with its own SPF and DKIM. DMARC alignment is relaxed by default, so this still passes, and the corporate record shrinks.
3. Replace a and mx with ip4. If your web or mail server IPs are stable, list them directly. ip4 is free.
4. Drop ptr. It is deprecated, slow, and costs a lookup.
5. Flatten carefully, as a last resort. Replacing includes with their resolved IP ranges works until the vendor changes IPs, which they do. Only do this with a tool that re-flattens automatically, and monitor the record.

Check your current count