You added one more tool that sends email as your business, and now a checker says "SPF PermError: too many DNS lookups." Your SPF record asks receiving servers for more than 10 lookups, so SPF stops working. The cause is almost always a pile of includes, and you can fix it without losing a single sender.
What does "SPF too many DNS lookups" mean?
"SPF too many DNS lookups" means your SPF record sends the receiving mail server on more than 10 DNS lookups, and the server gives up. The rule comes from the SPF standard. RFC 7208 section 4.6.4 says implementations "MUST limit the total number of those terms to 10" and that "If this limit is exceeded, the implementation MUST return 'permerror'." A permerror is a permanent error. The server can't tell whether your sender is approved, so SPF can't count as a pass for that message. Whatever else you set up, the message now leans entirely on DKIM to authenticate.
Which SPF entries count toward the 10-lookup limit?
Six terms count: include, a, mx, ptr, exists, and the redirect modifier. RFC 7208 lists exactly those terms in section 4.6.4. Entries that hold an IP address directly (ip4 and ip6) and the closing "all" don't trigger a lookup, so they're free. Microsoft's SPF guidance for Microsoft 365 lists the same split: include, a, mx, exists, and redirect each count as one lookup, while ip4, ip6, and all do not. The same RFC section also says implementations should limit "void lookups" to two. A void lookup is one that returns nothing, like an include that points at a domain with no SPF record. Go past two and the record returns a permerror even if the include count is low.
Why do nested includes use up the limit so fast?
Nested includes use up the limit because every include you add can contain more includes of its own, and the receiver counts all of them. Microsoft's documentation gives a clean example: an include that points to another SPF record containing three more includes adds four lookups in total, one for the first and three for the nested ones. So having fewer than 10 includes doesn't guarantee you're under the limit. Microsoft says that directly: "having fewer than 10 include: statements doesn't guarantee fewer than 10 DNS lookups." Your record might look short and still be over.
Why do small businesses in Battle Creek and Kalamazoo hit this limit?
Small shops hit the limit because every business tool wants its own include, and nobody removes the old ones. Say a contractor in Kalamazoo starts with Microsoft 365. Then comes an invoicing app, a CRM, an online scheduler, and a newsletter tool. Each one tells you to add an include to your SPF record. Each include can nest. Google's sender guidelines say to "make sure the SPF record for your domain includes all email senders for your domain," so the instinct is to keep adding. Nobody tells you the budget is 10. And when you quit a tool, its include usually stays in the record, still costing lookups. Shops that have been around a few years tend to have the most clutter.
How do I check how many lookups my SPF record uses?
You check by pulling your SPF record and counting lookups with a tool that follows every include. Look up the TXT record at your domain that starts with "v=spf1". Then run it through any SPF checker that reports a lookup count, since counting by hand misses the nested ones. Parallax has a free email security check that reads what your domain publishes. If the count says 11 or higher, or the checker flags a void lookup, you have the problem. Also look for more than one SPF record. Microsoft says multiple SPF records on the same domain also cause a permerror, so a domain gets exactly one.
How do I fix SPF too many DNS lookups step by step?
You fix it by cutting lookups without cutting any real sender. Work through these in order and recheck the count after each one.
- Delete dead includes. Remove any include for a tool you no longer use. This is the easiest win and it's often enough.
- Merge to one record. If you have two SPF records, combine them into one. Microsoft says to use only one SPF record per domain or subdomain.
- Remove ptr and extra a or mx entries. RFC 7208 counts ptr, a, and mx toward the limit, and entries that repeat what an include already covers are wasted lookups.
- Swap an include for IP addresses only when the vendor documents stable ones. Microsoft's guidance lets you replace an include with ip4 or ip6 values when a vendor has a stable, documented set of sending addresses. You then have to watch for changes yourself.
- Move bulk senders to a subdomain. Microsoft recommends a subdomain like marketing.yourdomain.com for services you don't control, and notes each subdomain gets its own 10-lookup budget.
- Consolidate tools. If two apps do the same job, fewer senders means a shorter record.
Don't forget to publish the new record and give DNS time to update before you test.
Should I flatten my SPF record?
Flattening can work, but it's the riskiest fix and you shouldn't use it on your main mailbox provider. Flattening means replacing includes with the actual IP addresses they point to. The catch is that vendors change those addresses. Microsoft says not to flatten include:spf.protection.outlook.com because its sending infrastructure uses dynamic IP addresses that change often. For vendors you do flatten, Microsoft advises documenting what you replaced, and reviewing the entries at least quarterly. An out-of-date flattened record causes a different problem, where real mail starts failing SPF with no error to warn you. If you can fix the count by deleting and consolidating, do that first.
Why does SPF fail for some receivers and not others?
SPF fails for some receivers and not others because the check stops as soon as it finds a match. Microsoft explains that destination systems read the record from left to right and stop once the sending source is validated. So a record with enough includes to go over 10 can still pass for a sender listed near the front, since the receiver never reaches the lookups that break it. A sender near the end of the record is the one that hits the wall. That's why a quote from your mailbox arrives fine, while an invoice from the app listed last gets rejected. It also means that putting your most-used senders first can help, but it isn't a fix. The count is still over the limit and the next change can push a working sender past it.
Will too many lookups make my email bounce?
It can. When SPF returns a permerror, Microsoft says the destination email system rejects the message with a bounce that reads "The message exceeded the hop count" or "The message required too many lookups." What happens next depends on the receiver and on your other records, so the problem can hide for weeks. Mail to one provider works and mail to another doesn't. If Outlook bounced you with 550 5.7.23, our 550 5.7.23 SPF fix walks through that bounce. If a customer's Gmail rejected you with 550 5.7.26, SPF trouble is one of the three common causes of that bounce. Setting up DKIM for every sender gives each message a second way to pass.
How common are email authentication gaps for Southwest Michigan businesses?
Authentication gaps are common here. A Parallax Intelligence audit found that 79.2% of 847 Southwest Michigan businesses that email from their own domain have no DMARC enforcement (1,527 checked), according to the Southwest Michigan Email Security Report. That audit looks at public DNS records, and it doesn't count SPF lookups, so it doesn't tell us how many local domains are over the limit. What it does show is that most local domains haven't finished the job, and SPF is one of the three pieces. Our explainer on SPF, DKIM, and DMARC shows how the three fit together, and setting up DMARC is the next step once your SPF record is clean.
When should I get help with an SPF lookup problem?
Get help when you can't tell which includes are safe to remove, or when you've fixed the count and mail still lands in spam. Pulling the wrong include out of an SPF record can quietly break invoices or quotes from a tool you forgot about. It takes a look at DMARC reports to find every sender, and that's the slow part. If you run a business in Battle Creek, Kalamazoo, Portage, or anywhere in Southwest Michigan and you'd rather hand it off, the Parallax email security service starts with a free one-minute check of what your domain publishes, then goes step by step through every tool that sends as you. Call (269) 460-1772 or use the contact form, and tell me what your checker says.