SPF "too many DNS lookups" (PermError): what it means and how to fix it

Your emails may have been ending up in spam folders due to an overabundance of DNS lookups in your Sender Policy Framework (SPF) record. The rule states that there can only be 10 lookups in total, counted recursively. If you exceed this limit, your legitimate emails will be incorrectly marked as SPF failed and filtered out.

An SPF record includes various elements, such as include, a, mx, ptr, exists, and ip4 or ip6 addresses. Each of these elements counts as one lookup when used, except for ip4:, ip6:, and all, which are free. However, the tricky part is that an include statement can itself expand into more include statements, leading to an unexpected number of lookups. For example, add a few senders from different services, and you might unknowingly exceed the 10-lookup limit.

To diagnose this issue, first resolve your TXT record and walk through the includes, adding up the lookup-causing terms across the entire tree. Use a tool like dig to scan through the TXT record and grep for spf1. After identifying the culprit, remove or simplify any unnecessary senders, flatten stable include statements into ip4: or ip6: ranges (free lookups), or delegate by subdomain if appropriate.

Finally, consider implementing Sender Policy Framework (SPF) in combination with DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting, and Conformance (DMARC) policies. Properly configured, SPF, DKIM, and DMARC together will significantly reduce the chances of your emails being filtered out into spam folders. Tools like the zero-config CLI 'domain-doctor' can help you easily diagnose and fix SPF issues, generating a graded report with recommended fixes.