SPF too many lookups with MailAuth Doctor
Enter your domain and the checker follows every include, counts the DNS lookups the way RFC 7208 defines them, and lists what each include costs so you know what to remove.
- Enter your domain and run the check.
- Read the lookup meter: 10 or fewer is valid, above 10 is a permanent error.
- Open "What each include costs" and find the services you no longer use.
- Remove them, republish the record and run the check again.
What to know
RFC 7208 allows at most 10 DNS lookups while evaluating an SPF record. The mechanisms that cause a lookup are include, a, mx, ptr, exists and the redirect modifier, counted across the whole include tree; ip4, ip6 and all do not count. When the limit is exceeded, receivers return a permanent error (permerror) and SPF stops working for the domain, so mail can fail authentication even though every sender is listed.
The count surprises people because it includes nested includes: one include:provider can cost several lookups if that provider's own record includes others. Providers also edit their records. We measured Mailgun at 5 lookups, Zoho Mail at 5 and Freshdesk at 7 on 2026-10-10, while Google Workspace, Microsoft 365 and Mailchimp cost 1 each. Older guides still claim Google costs 4 or more: Google now publishes plain IP ranges, so measure instead of trusting a table.
To get back under the limit, remove services you no longer send from, replace an include with the ip4/ip6 ranges you control when the provider guarantees they are stable, or move bulk mail to a subdomain with its own SPF record. Avoid "flattening" a provider into IP lists by hand: the lists go stale when the provider changes them and mail then fails silently.
Updated · Cosmovex
Questions
What is the SPF 10 lookup limit?
RFC 7208 allows at most 10 DNS lookups caused by include, a, mx, ptr, exists and redirect during an SPF evaluation, including nested includes. More than that is a permanent error.
Do ip4 and ip6 count towards the limit?
No. Only mechanisms and modifiers that need a DNS query count. ip4, ip6 and all are free.
What happens if my SPF exceeds 10 lookups?
Receivers return permerror, which means SPF cannot be evaluated. Many treat that as a failure, and DMARC then relies on DKIM alone.
Is there a limit on void lookups too?
Yes: RFC 7208 says implementations should stop after more than two lookups that return nothing (NXDOMAIN or an empty answer). The checker reports both numbers.
The free plan covers everything on this page. MailAuth Doctor Pro ($7/mo, billed monthly) is described on the MailAuth Doctor page.
