Our SPF record returns permerror, too many DNS lookups
RFC 7208 allows at most 10 DNS lookups per SPF evaluation. Each include, a, mx, ptr, exists counts, including nested includes. Above that limit SPF breaks with permerror, which many receivers treat as fail.
Try this first
- 1Count includes with an SPF validator like dmarcian SPF Surveyor or Mailhardener. It shows the whole tree including recursive lookups inside _spf.google.com and similar.
- 2Remove includes that are no longer in use. Old ESPs, a previous CRM, a marketing tool you stopped using: those often linger in SPF.
- 3Replace large includes with SPF flattening via a service that refreshes IP ranges, for example dmarcian, autospf, or mxtoolbox flattening. Don't flatten by hand because Google and Microsoft IP ranges change.
- 4Optionally split send paths: marketing on a subdomain like news.yourdomain.com with its own SPF, transactional on the apex.
- 5Verify with dig txt yourdomain.com and a lookup counter that you sit under 10. Wait for TTL before retesting.
When to bring us in
If you can't get under 10 without dropping important senders, a redesign of the mail flow is needed. An hour of drawing this together avoids flatten-on-flatten.
See also
- Our emails land in spam for some recipientsAlmost always an SPF, DKIM, or DMARC setting that is wrong or missing, or a sender name that mimics a well-known brand.
- Someone reports receiving phishing emails "from us"Read: spoofing. Someone is abusing your sender name, not necessarily your actual mailbox.
- An email bounces (NDR): delivery failedThe NDR text usually states the exact reason. Reading it is step one.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.