{
  "id": 19763036,
  "title": "How to fix \"SPF permerror: too many DNS lookups\"",
  "url": "https://urgent.news/2026/11/13/how-to-fix-spf-permerror-too-many-dns-lookups",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-13T05:43:13.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/hanzala_rasool_6d069eeab1/how-to-fix-spf-permerror-too-many-dns-lookups-1f0a"
  },
  "original_language": "en",
  "account": "SPF, or Sender Policy Framework, has a strict limit of just 10 DNS lookups when checking a record. Exceeding this limit results in a permerror, which many email receivers interpret as a failed SPF check, potentially sending your mail to the spam folder. This issue often arises unexpectedly as you add more services that send emails on your behalf.\n\nTo keep track of how many DNS lookups your SPF record uses, you can perform an nslookup on your domain using the command: nslookup -type=txt yourdomain.com. For each included domain, repeat this process by counting every include, a, mx, ptr, and exists. Alternatively, you can use online SPF checkers like the free SPF & DMARC check to simplify the process.\n\nIf your top-level SPF record is nearing its limit, consider removing unused services, such as old newsletter tools or CRMs. If your servers have fixed IP addresses, replace the A and MX records with IP addresses (ip4:) since these do not require DNS lookups. Additionally, removing the ptr record is recommended, as it is deprecated and slow.\n\nAnother option is to send marketing emails from a subdomain, like news.yourdomain.com, with its own dedicated SPF record. This way, each domain gets its own set of 10 lookups. However, be cautious when flattening records, as replacing an include with its constituent IP addresses can save lookups, but may lead to silent SPF failures if the provider changes its IP addresses. Always use a tool that keeps your SPF record updated.\n\nIt's important to note that setting up DKIM (DomainKeys Identified Mail) alongside SPF can help ensure email deliverability. While SPF and DKIM passing together can make SPF less critical, some services may not be compatible with SPF and may require additional steps. To ensure proper email delivery, send a test email from Gmail, open it, choose \"Show original,\" and look for \"PASS\" next to SPF, DKIM, and DMARC.",
  "summary": "SPF has a hard limit: checking your record may take no more than 10 DNS lookups . Go over it and the result is permerror , which many receivers treat as a failed SPF check, so your mail is more likely to land in spam. It usually creeps up on you as you add more services that send email for you. What counts towards the 10 Counts: include: , a , mx , ptr , exists: and redirect= Doesn't count: ip4:…",
  "key_points": [
    "SPF has strict 10 DNS lookup limit",
    "Exceeding limit causes permerror",
    "Causes mail to be flagged as failed SPF check"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}