SPF error: too many DNS lookups (permerror)

What it means

Your SPF record is a list of allowed senders. Some items in that list, like include:, a, mx and redirect=, force the receiving server to look up more DNS records. Each include can also contain more includes.

The SPF rules set a hard limit: 10 lookups in total. Above that, receivers stop and return a "permerror", which means "permanent error". Your SPF is then treated as broken.

Why it matters

A broken SPF is almost as bad as no SPF. Your real emails can fail SPF, which can also make DMARC fail, and they end up in spam or rejected. This often happens slowly: each time you add a new tool (newsletter, CRM, helpdesk), you add an include, until one day you go over 10.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. The SPF line shows "permerror" when the limit is exceeded.
• Use the Domain scanner: type your domain at /domain-scanner to read your DNS records without sending anything.

The Domain scanner also shows how many lookups your record uses, for example "12/10 DNS lookups".

How to fix it

1. Remove services you no longer use. Old newsletter tools and former hosts are the most common culprits.
2. Remove duplicates. The same include written twice still counts twice.
3. Remove a and mx if they are not needed. They only matter if your website server or your incoming mail server also sends email. With Google Workspace or Microsoft 365, the include already covers it.
4. Replace with IP addresses where you can. ip4: and ip6: entries cost zero lookups. Only do this for servers you control, whose IP addresses do not change.
5. Move some senders to a subdomain. Marketing emails can be sent from news.yourdomain.com, with its own SPF record and its own 10 lookups.

Example

Before (too many lookups):

v=spf1 a mx include:_spf.google.com include:spf.protection.outlook.com include:servers.mcsv.net include:sendgrid.net include:mail.zendesk.com include:spf.oldtool.example ~all

After (the company left Microsoft 365 and the old tool, and its mail is handled by Google):

v=spf1 include:_spf.google.com include:servers.mcsv.net include:sendgrid.net include:mail.zendesk.com ~all

A word about "SPF flattening"

Some tools offer to "flatten" your SPF by replacing includes with long lists of IP addresses. It works, but if your provider changes its IP addresses, your SPF silently becomes wrong. Prefer the steps above first.

Other causes of permerror

• A typo, such as v=spf1 written v=spf, or include: without a value.
• Two SPF records on the same domain (see the guide on several SPF records).

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.

Run the Domain scanner again: the lookup count should be 10 or less and the record should be valid. Then send a test email from the home page and confirm that SPF passes.