How to fix "SPF permerror: too many DNS lookups"
SPF has a hard limit: checking your record may take no more than 10 DNS lookups . Go over it and the result is permerror , which many receivers treat as a failed SPF check, so your mail is more likely to land in spam. It usually creeps up on you as you add more services that send email for you. What counts towards the 10 Counts: include: , a , mx , ptr , exists: and redirect= Doesn't count: ip4:…
SPF, or Sender Policy Framework, has a strict limit of just 10 DNS lookups when checking a record. Exceeding this limit results in a permerror, which many email receivers interpret as a failed SPF check, potentially sending your mail to the spam folder. This issue often arises unexpectedly as you add more services that send emails on your behalf.
To keep track of how many DNS lookups your SPF record uses, you can perform an nslookup on your domain using the command: nslookup -type=txt yourdomain.com. For each included domain, repeat this process by counting every include, a, mx, ptr, and exists. Alternatively, you can use online SPF checkers like the free SPF & DMARC check to simplify the process.
If your top-level SPF record is nearing its limit, consider removing unused services, such as old newsletter tools or CRMs. If your servers have fixed IP addresses, replace the A and MX records with IP addresses (ip4:) since these do not require DNS lookups. Additionally, removing the ptr record is recommended, as it is deprecated and slow.
Another option is to send marketing emails from a subdomain, like news.yourdomain.com, with its own dedicated SPF record. This way, each domain gets its own set of 10 lookups. However, be cautious when flattening records, as replacing an include with its constituent IP addresses can save lookups, but may lead to silent SPF failures if the provider changes its IP addresses. Always use a tool that keeps your SPF record updated.
It's important to note that setting up DKIM (DomainKeys Identified Mail) alongside SPF can help ensure email deliverability. While SPF and DKIM passing together can make SPF less critical, some services may not be compatible with SPF and may require additional steps. To ensure proper email delivery, send a test email from Gmail, open it, choose "Show original," and look for "PASS" next to SPF, DKIM, and DMARC.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
