How to Fix SPF PermError (Too Many Lookups)
SPF silently stops working when it exceeds 10 DNS lookups — that's PermError. Here's how to diagnose and fix it so your mail authenticates.
TL;DR
SPF allows a maximum of 10 DNS lookups. Exceed it and you get PermError, breaking SPF authentication. Fix it by removing unused includes or flattening your record.
The 10-lookup limit
The SPF spec (RFC 7208) caps DNS lookups at 10 to prevent abuse. Every include:, a, mx and redirect counts. Go over and validators return PermError — SPF effectively fails.
Why it happens
It creeps in over time: you add an ESP, a CRM, a ticketing tool — each with its own include:, each pulling in more lookups. Eventually you cross 10 without noticing.
How to diagnose
Use an SPF checker (e.g. MXToolbox) to count lookups. It'll show exactly which includes consume your budget.
How to fix it
- Remove unused includes — old services you no longer send from.
- Consolidate senders where possible.
- Flatten — replace includes with their resolved IP ranges (but maintain it, as IPs change).
- Use subdomains for different sending sources to spread the budget.
Example
v=spf1 ip4:192.0.2.0/24 include:_spf.essential.com -allLean and under budget. Keep only what you actually send from.
Don't break DMARC
A passing SPF feeds DMARC alignment. Fixing PermError restores that chain.
AutoPMTA's DNS Health flags SPF lookup overruns before they cause PermError. View plans.
Key takeaways
- SPF fails (PermError) above 10 DNS lookups.
- Includes from many services accumulate over time.
- Remove unused includes, consolidate, or flatten.
- A clean SPF keeps DMARC alignment intact.
Frequently asked questions
What causes SPF PermError?+
SPF PermError is most commonly caused by exceeding the 10 DNS-lookup limit defined in RFC 7208. Each include, a, mx and redirect mechanism counts toward that limit.
How do I fix too many SPF lookups?+
Remove includes for services you no longer use, consolidate senders, flatten includes into resolved IP ranges, or split sources across subdomains to stay under 10 lookups.
Does SPF PermError affect deliverability?+
Yes. PermError means SPF effectively fails, which weakens DMARC alignment and can push your mail to spam or cause rejections.