Too many DNS lookups
SPF evaluation exceeds the ten-lookup limit.
Problem summary
SPF evaluation exceeds the ten-lookup limit.
Symptoms
- SPF checkers report more than ten DNS lookups
- spf=permerror after adding another include
- Nested ESP includes push the chain over the limit
Possible causes
- Too many include/a/mx/exists/redirect terms
- Vendors whose includes themselves expand heavily
- Legacy mechanisms left after migrations
How to diagnose
- Expand the full SPF tree with a lookup counter
- Identify unused or duplicate includes
- Map which senders can move to a subdomain with its own SPF
How to fix
- Remove unused includes; flatten with ip4/ip6 where you control the space
- Move overflow platforms to dedicated sending subdomains
- Replace recursive vendor chains when a flatter mechanism is offered
How to verify
- Lookup count ≤ 10 including nested includes
- Production paths still spf=pass
Prevention
- Budget lookups before onboarding each new ESP
- Quarterly SPF inventory against active senders
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts