SPF too many DNS lookups: the limit of 10 and how to get under it

The limit protects receivers. Without it, one SPF record could make a mail server send dozens of DNS queries for every message, and an attacker could use that to flood someone else's name servers. So the RFC sets a hard cap, and a receiver that follows it stops as soon as an eleventh lookup is needed.

It's easy to go over without noticing. Each email service you add hands you an include, and that include often has includes of its own. The record on your domain might show four terms while the real count is twelve. RFC 7208 also tells receivers to allow at most two void lookups (ones that come back with no records or a name that doesn't exist), so includes that point at retired names hurt twice.

Ways to get back under the limit, from safest to riskiest:

• Remove includes for services that no longer send mail for you.
• Replace a and mx terms with the ip4 and ip6 ranges they stand for, if those addresses rarely change.
• Drop ptr. The RFC says not to use it.
• Move a bulk sender to its own subdomain, like news.example.com, with its own SPF record.
• Flatten includes into IP lists. This works, but it breaks quietly when a provider changes its addresses, so only do it with a service that keeps the list up to date.

The DNS Lookup follows every include and redirect, counts the lookups through the whole tree, and shows how many each include uses, so you can see which one to cut.