SPF has too many DNS lookups
On every plan
An SPF check may make at most 10 lookups. A record that needs more fails SPF for every message, because mailbox providers stop at the limit. To get under it, remove the includes no source uses, list your own servers by address, and rely on DKIM for the services that offer it.
How lookups are counted
Each include, a, mx, ptr, exists and redirect costs one lookup, and the lookups inside an include count too. ip4, ip6 and all cost nothing. A record that ends in all ignores its redirect, so we do not count it there. The SPF card on the domain's DNS tab counts them for you:
- From 8 lookups, the card warns that one more sending service could push the record over.
- Above 10 lookups, it shows a problem: mailbox providers stop there and fail the check.
- Lookups that find nothing, a name with no address or an include with no SPF record, have a limit of their own, 2 lookups. Above it, the card warns.
- An include of a name that has no SPF record is a problem of its own, because SPF returns an error when a check reaches it.
When we cannot read one of the included records, the card says so, and the count is a minimum until we can. Above 10 lookups, the card still shows the problem. Below it, it gives no warning about being near the limit, because the real count may be higher.
Find what costs the most
The SPF card opens into a tree of your record. Each include shows the service behind it, when we recognise one, and how many lookups it costs with everything it includes in turn.
Remove includes no source uses
When your SPF record includes a service we recognise, and no report in the last 30 days shows mail from it, the SPF card says so and how many lookups removing it would save. We say it only when there are enough reports: from at least 14 days in that time. An include that two services share is never flagged, because we cannot tell which of them you use.
A service that sends only now and then, a quarterly newsletter for example, can look unused. Make sure nobody uses it before you remove its include.
List your own servers by address
For a server of your own with fixed addresses, replace its include, a or mx term with its ip4 or ip6 addresses. Addresses cost no lookups. Do this only for addresses you control. A sending service can change its addresses at any time, so keep its include.
Rely on DKIM
DKIM costs no SPF lookups, and mail signed with your domain passes DMARC through DKIM alone. Where a service can sign with your domain, set that up in the service.
When a source's Explanation on the Sources page says SPF passes for the service's own bounce domain, that mail is not checked against your SPF record at all. Ask the service whether its include in your record is still needed before you remove it.
We do not flatten SPF records
Some tools replace each include with the addresses behind it, which is called flattening. We do not offer it. A flattened record has to be rebuilt every time a service changes its addresses.
The Playbooks section of the app has a guide to the whole SPF record.
Published 27 October 2026 · Checked 27 October 2026