How to fix "SPF too many DNS lookups"

If your CyberVigil report says your SPF record needs more than 10 DNS lookups, the record has grown too long for email providers to check in full. The fix is usually a cleanup rather than a rebuild, and it takes about half an hour.

Run your domain through the checker first. It shows your current record and its lookup count, which you'll need for the steps below.

What does "too many DNS lookups" mean?

Your SPF record lists the services allowed to send email for your domain. Most are listed by name with include:, and each name has to be looked up in DNS to find the servers behind it. Those records can contain more includes of their own.

The SPF standard, RFC 7208, caps this at 10. Section 4.6.4 counts the include, a, mx, ptr and exists mechanisms and the redirect modifier, and says that if the total goes over 10, the receiver "MUST return 'permerror'", which is a permanent error. ip4:, ip6: and all don't count.

Our scan follows your includes and adds up the lookups. When the total passes 10, we mark SPF as needing attention. The checker stops counting once it's over the limit, so your real number may be higher than the one in your report.

Why does going over the limit matter?

A permanent error means the receiving provider can't confirm your email is legitimate. Microsoft says the message fails SPF and can be rejected with a bounce that mentions too many lookups.

The failures often look random. Providers read the record left to right and stop at the first match, so mail from a service listed early may pass while mail from one listed near the end fails. If you use DMARC, messages signed with DKIM for your domain can still pass, which hides the problem further.

How do I reduce my SPF lookups?

Work through these steps in order, and re-check after each change.

Step 1: List what's in your record

Copy your current record from the checker. Next to each include:, write down which service it belongs to. The domain after include: usually names the company, for example servers.mcsv.net for Mailchimp or mail.zendesk.com for Zendesk.

Step 2: Remove senders you no longer use

Leftovers are the most common cause. A business switches email providers or cancels a newsletter tool, and the old include stays behind. Google's SPF guide says to keep the record current "by removing any domains or IP addresses that you no longer use for sending email."

Here's a typical case. This business moved from Microsoft 365 to Google Workspace, stopped using GoDaddy email and Salesforce, and still had a and mx left over from an old web host:

Only delete an include once you're sure nothing uses it. If you're unsure, ask whoever set up the tool or check its help docs for SPF. Removing the include for a service you still use will make its email fail.

Step 3: Drop terms you don't need

mx approves the servers that receive your email. With Google Workspace or Microsoft 365, the include already covers your outgoing mail, so mx usually adds nothing. a approves the server your website runs on, which only matters if that server sends email itself, such as a contact form on your own hosting. Remove both unless you know you need them.

Remove ptr if you see it. RFC 7208 says "This mechanism SHOULD NOT be published" because it's slow and unreliable. Also look for the same include listed twice.

Step 4: Move bulk email to a subdomain

If you send newsletters or marketing campaigns, Microsoft recommends sending them from a subdomain such as news.yourbusiness.com. Each subdomain has its own SPF record and its own 10-lookup budget, and problems with bulk mail won't drag down the reputation of your everyday email.

This only works if the tool lets you send from a subdomain, and you'll usually set up DKIM for the subdomain inside that tool too. Check its help docs before changing anything.

Step 5: Save one record and re-check

Edit your existing SPF record with the new value. Don't add a second record, because two SPF records on the same name cause a permanent error for both. Then re-run the SPF checker and confirm the count is 10 or fewer.

Check the rest of your email setup

Run a free scan to see your SPF, DKIM, DMARC and website settings in one plain-English report.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

Should I use SPF flattening?

Flattening means replacing an include: with the IP addresses it points to today, written as ip4: and ip6: entries. IP addresses don't count toward the limit, so a flattened record can cover many services with very few lookups.

The cost is upkeep. An include always reflects the provider's current servers, while a flattened list is a snapshot. When the provider adds or changes servers, your record goes out of date without any warning, and mail from the new servers starts failing SPF.

Microsoft's guidance is a sensible rule of thumb. Only flatten services with stable, documented IP ranges. Never flatten Microsoft 365's include:spf.protection.outlook.com, because Microsoft says its sending addresses change frequently. Write down what you replaced and when, and review flattened entries at least quarterly.

Automated flattening services track the addresses for you, which removes the manual work but makes your email depend on that service keeping your DNS correct. Try the cleanup steps first. They fix the problem without adding anything new to maintain.

How do I update SPF at my DNS host?

Your SPF record lives wherever your domain's DNS is hosted, usually the company you bought the domain from or Cloudflare. Edit the existing TXT record that starts with v=spf1 rather than adding a new one.

What should you do next?

• Re-run the free SPF checker after each change until the count is 10 or fewer.
• Send a test from each service that still sends as you, and look for spf=pass in the message headers.
• With SPF fixed, make sure DKIM is on and your DMARC policy is in place.
• Before you add a new email tool, check whether it can send from a subdomain so your main record stays short.