If SPF reports permerror because of too many DNS lookups, audit the entire policy evaluation—not just the SPF string published on your domain. RFC 7208 sets a maximum of 10 DNS-evaluating terms across the root record and the policies it reaches recursively. Remove or consolidate a term only after confirming that every legitimate sender remains authorized.
What counts toward SPF’s 10-lookup limit?
RFC 7208 §4.6.4 counts DNS-evaluating terms throughout a complete SPF evaluation. The terms in an included policy count too, so a short-looking root record can exceed the limit through nested providers.
As an Amazon Associate I earn from qualifying purchases.
| Term | Counts toward 10? | How to treat it |
|---|---|---|
include |
Yes | Evaluates the referenced SPF policy recursively. |
a |
Yes | Performs an address lookup. |
mx |
Yes | Counts as a DNS-evaluating term; it is also subject to a separate limit of 10 address records queried for each MX record. |
ptr |
Yes | Counts, and RFC 7208 says it should not be published. |
exists |
Yes | Performs an A lookup for its expanded domain. |
redirect |
Yes | Evaluates another policy if mechanisms in the current policy do not match. |
all, ip4, ip6 |
No | Do not cause DNS queries during SPF evaluation. |
exp |
No | Its explanation lookup occurs later, not during SPF evaluation. |
The standard’s limit is not a count of every DNS packet a mail transaction may involve; it is a limit on the listed DNS-evaluating terms in the SPF evaluation. RFC 7208 states: “If this limit is exceeded, the implementation MUST return "permerror".” (RFC 7208 §4.6.4.)
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Why can SPF return permerror?
Exceeding the global 10-term limit is one cause. It is different from an SPF fail, which is an evaluation result rather than this permanent processing error. A record can also produce permerror for other reasons, so do not assume that a validator’s error is necessarily the 10-term limit.
#1 Best Overall
- More than one SPF record: Multiple SPF records in a domain’s TXT result set produce
permerror, even if neither policy exceeds 10 terms. RFC 7208 §3.2. - Too many void lookups: A void lookup is a query that returns a successful DNS response with no answers, or a name error. SPF implementations should limit void lookups to two; the RFC recommends a default of two. Exceeding the configured limit produces
permerror. RFC 7208 §4.6.4. - Too many address records for an MX: The separate cap is 10 address records queried for each MX record. This is not the global count of SPF terms. RFC 7208 §4.6.4.
These limits are easy to confuse: count DNS-evaluating terms for the global cap, and separately consider void responses, MX address-record queries, and duplicate SPF records.
How to audit an SPF policy safely
- Retrieve the domain’s TXT records. Find the SPF record and check that the domain does not publish multiple SPF records. If it does, resolve that issue separately; merging senders into one policy is not the same as simply deleting a record without checking what it authorizes.
- Count the root record’s DNS-evaluating terms. Tally each
include,a,mx,ptr,exists, andredirect. Do not addall,ip4,ip6, orexpto this tally. - Follow the evaluation recursively. Inspect every referenced
includepolicy and any effectiveredirectpolicy. Add the DNS-evaluating terms reached through those policies to the overall count. A top-level record with only a few terms may still exceed 10. - Map each authorization to a real sender. Identify which mail systems send for the domain and whether each still needs authorization. Look for redundant mechanisms or senders that have been retired; do not remove a provider just to make the count smaller.
- Make the smallest correct change. Remove mechanisms that are no longer needed or consolidate authorization only if the revised policy preserves the required sender behavior. An
includeevaluates the referenced policy; it does not automatically accept every message associated with that provider. - Recheck the published record and references. After DNS changes have propagated, repeat the count using the current root record and referenced policies. There is no universal propagation interval established here; timing depends on the DNS changes and provider behavior.
How should you reduce lookup pressure?
Remove obsolete or redundant mechanisms
Start with terms that no longer serve a sending system or whose authorization is already provided elsewhere in the policy. Confirm the actual effect before editing: SPF mechanisms are evaluated in order, and changing or removing one may alter which senders match.
Use explicit authorization where it fits
RFC 7208 recommends keeping the DNS information needed to evaluate an SPF record to a minimum. Use mechanisms appropriate to the sending infrastructure and maintain them as that infrastructure changes. The RFC says ptr should not be published; prefer explicit, maintained authorization rather than adding reverse-DNS-based policy.
Recommended Free Tools
Use redirect for shared policy, not as a bypass
redirect can consolidate policy for domains under shared administration, but it counts toward the limit and evaluates another policy when reached. That policy can contain further DNS-evaluating terms, so redirecting does not bypass the cap.
Rank #3
- Used Book in Good Condition
Treat flattening as a maintenance choice
Replacing provider include terms with copied IP ranges may reduce recursive DNS evaluation, but it transfers responsibility for keeping those ranges accurate to whoever maintains the SPF record. Do not flatten unless you have a reliable update process and have confirmed that the changed policy preserves the intended authorization behavior. No provider’s ranges or update process are established here as safe for copying.
What to remember about the limit
The 10-term cap applies to DNS-evaluating SPF terms across the full recursive evaluation. Check duplicate records and the separate void-lookup and MX address-record conditions when diagnosing permerror; then reduce the policy only in ways that preserve authorization for legitimate senders. RFC 7208’s record-design guidance is concise: “ADMDs publishing SPF records ought to keep the amount of DNS information needed to evaluate a record to a minimum.” (RFC 7208 §3.)
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
