SPF "too many DNS lookups" (permerror): why it happens and how to fix it

SPF records that contain the phrase "permerror" or "SPF exceeded 10 DNS lookups" are being disregarded by email receivers, despite the appearance of the record. The limit of 10 DNS-querying terms applies when evaluating one SPF record, and these include include, a, mx, ptr, exists, and redirect. However, the terms ip4, ip6 and all do not count. Recursive looks are also a factor, as each include: adds the number of lookups contained within the record it points to.

For example, include:_spf.google.com is one lookup that expands to several more. When you combine this with other services like marketing platforms, a helpdesk, a CRM, and Microsoft 365, you can easily surpass the 10-lookup limit. An additional limit to be aware of is the presence of more than 2 'void' lookups, which also result in a permerror.

To resolve the issue, count the lookups accurately by resolving each include and counting the terms within them. Remove any elements that are no longer in use, such as cancelled tools or old hosting providers. Replace variable lookups with fixed addresses when possible. Split the SPF records by sending subdomains, each with its own SPF record and lookup budget. When flattening, be cautious as provider ranges change and a static flattened record can go stale.

Once you've made the necessary changes, verify that the SPF record has been updated to 10 or under, with no more than 2 'void' lookups. Test the changes by sending test emails to Gmail and Outlook addresses, and check the Authentication-Results for spf=pass. Treat the lookup count as an ongoing management task, similar to monitoring certificate expiry, rather than a one-time fix.