{
  "id": 16608662,
  "title": "SPF \"too many DNS lookups\" (PermError): what it means and how to fix it",
  "url": "https://urgent.news/2026/10/26/spf-too-many-dns-lookups-permerror-what-it-means-and-how-to-fix-it",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-26T13:54:18.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/northwebdev/spf-too-many-dns-lookups-permerror-what-it-means-and-how-to-fix-it-1fbh"
  },
  "original_language": "en",
  "account": "Your emails may have been ending up in spam folders due to an overabundance of DNS lookups in your Sender Policy Framework (SPF) record. The rule states that there can only be 10 lookups in total, counted recursively. If you exceed this limit, your legitimate emails will be incorrectly marked as SPF failed and filtered out.\n\nAn SPF record includes various elements, such as include, a, mx, ptr, exists, and ip4 or ip6 addresses. Each of these elements counts as one lookup when used, except for ip4:, ip6:, and all, which are free. However, the tricky part is that an include statement can itself expand into more include statements, leading to an unexpected number of lookups. For example, add a few senders from different services, and you might unknowingly exceed the 10-lookup limit.\n\nTo diagnose this issue, first resolve your TXT record and walk through the includes, adding up the lookup-causing terms across the entire tree. Use a tool like dig to scan through the TXT record and grep for spf1. After identifying the culprit, remove or simplify any unnecessary senders, flatten stable include statements into ip4: or ip6: ranges (free lookups), or delegate by subdomain if appropriate.\n\nFinally, consider implementing Sender Policy Framework (SPF) in combination with DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting, and Conformance (DMARC) policies. Properly configured, SPF, DKIM, and DMARC together will significantly reduce the chances of your emails being filtered out into spam folders. Tools like the zero-config CLI 'domain-doctor' can help you easily diagnose and fix SPF issues, generating a graded report with recommended fixes.",
  "summary": "Your mail quietly started landing in spam, and when you checked SPF you found this: PermError: too many DNS lookups . Here's exactly what that means and how to fix it without guessing. The rule nobody tells you about SPF (RFC 7208) caps the number of DNS-lookup-causing terms in your record at 10 . Not 10 records — 10 lookups , counted recursively. Blow past it and a correct receiver returns…",
  "key_points": [
    "SPF record limit of 10 DNS lookups",
    "Exceeding limit marks emails as SPF failed",
    "Tools like dig help diagnose issue"
  ],
  "editors_take": "Exceeding the ten-lookup limit in SPF records forces legitimate mail into spam folders, necessitating a shift toward flattened IP ranges or subdomains to maintain effective email authentication.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}