SPF validation fails with 'too many DNS lookups', more than 10 includes
RFC 7208 limits SPF to 10 DNS lookups (include, a, mx, ptr, exists). With each new SaaS sender that stacks above 10 fast, and receivers return PermError, breaking alignment.
Try this first
- 1Count current lookups via mxtoolbox.com SPF tool. Above 8 is the danger zone.
- 2Flatten the SPF: replace vendor includes with their hard IP ranges (if they publish them). Less elegant, but 0 lookups.
- 3Use an SPF-flatten service (dmarcian-flat, EasyDMARC, or a homegrown hourly cron job), so you stay dynamic but under 10.
- 4Remove includes for vendors you no longer use, often low-hanging fruit.
- 5Reconsider whether every vendor must align via SPF, sometimes DKIM-only for a vendor is enough for DMARC alignment.
When to bring us in
If you have a complex SPF and no flatten tooling, we can set up a maintained SPF flat with monitoring so you do not get silent bounces.
See also
- Domain expires tomorrow and nobody saw the emailAn expired domain doesn't transfer instantly. There's a redemption window, but you pay extra.
- Unsure whether to enable auto-renewDisabling auto-renew only makes sense for domains you'll truly drop. For anything live, just keep it on.
- New registrar asks for auth code, can't find itEPP code or transfer code is the password to move a domain from registrar A to B.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.