The SPF 10-lookup limit
Every include, a, mx, ptr and exists mechanism in an SPF record costs one DNS lookup. The specification caps the total at ten, and exceeding it is a permanent error.
The constraint
Ten DNS lookups, no exceptions.
RFC 7208 section 4.6.4 limits SPF evaluation to ten DNS lookups. This prevents a malicious SPF record from causing a denial of service through recursive includes. The count is absolute: once the tenth lookup fires, every subsequent mechanism is a permanent error, not a soft failure.
What counts as a lookup
| Mechanism | Lookups |
|---|---|
include | 1 + whatever the included record costs |
a | 1 |
mx | 1 + 1 per MX host resolved |
ptr | 1 (deprecated, do not use) |
exists | 1 |
redirect | 1 + whatever the target costs |
ip4, ip6 | 0 (no DNS query) |
How to count yours
Use the spam checker to see the direct lookup cost of your SPF record. The tool parses every term and counts the DNS lookups it would cost.
Flattening
When includes push you over ten, replace them with the
ip4 and ip6 addresses they
resolve to. This is called flattening. The trade-off: if
the provider changes their IP addresses, your flattened
record goes stale. Re-flatten on a schedule or use a
service that does it automatically.
What can go wrong
Related findings.
| Finding | What it means |
|---|---|
spf_too_many_lookups
|
Too many SPF lookups |
spf_deprecated_ptr
|
Deprecated ptr in SPF |
More guides
Keep reading.
How SPF works
SPF declares which servers may send mail for a domain. A TXT record in DNS lists IP addresses and includes, and a receiver evaluates them in order.
How DKIM works
DKIM attaches a cryptographic signature to each message. The receiver fetches the public key from DNS and verifies that the message was not altered after signing.
How DMARC works
DMARC ties SPF and DKIM together by requiring that at least one of them aligns with the From header domain. It tells receivers what to do when neither does.
SPF, DKIM and DMARC alignment
Authentication alone is not enough. DMARC requires that the domain authenticated by SPF or DKIM matches the domain in the From header the recipient sees.
DKIM selectors explained
A selector is the label that tells the receiver which public key to fetch from DNS. Different services use different selectors, and rotating them is how you change keys without downtime.
DMARC aggregate reports
Aggregate reports are XML files that receiving domains send to the address in your rua tag. They show who is sending mail as your domain, and whether it passes or fails.