The SPF standard allows at most ten DNS lookups while a receiver checks one message. Pass that limit and the check ends with an error instead of a result.
The mechanisms include, a, mx, ptr and exists each cause a lookup, and so does the redirect modifier. The ip4, ip6 and all mechanisms do not.
Each include points to another provider's SPF record, and that record may include others. Several email services in one record can use up the ten quickly.
The receiver reports a permanent error, often shown as permerror. Many receivers then treat SPF as failed, so genuine email can be affected.
Follow each include in turn and count every lookup. Remove services you no longer use, and replace an include with fixed IP ranges only where those ranges are stable.
DNS Domain Detective reads your SPF record so you can see what it contains. Open DNS Domain Detective
DNS Domain Detective is now available on the App Store.
Last reviewed: 2026-11-02
#DNS #DKIM #SPF #DMARC #EmailSecurity #SysAdmin #MSP #iOS
This page gives general information and is not legal, financial or medical advice. [email protected]