How to Fix SPF Too Many DNS Lookups (the 10 Lookup Limit)

Step-by-step

1. Run your domain through the SPF Validator and note the total lookup count and which includes use the most.
2. List the services in the record and remove any you no longer use. Old marketing and support tools are common leftovers.
3. Remove a and mx terms you do not need. Each costs a lookup, and your mail servers may already be covered by an include.
4. Look at the includes that nest several others. A large provider's include can use three or four lookups on its own.
5. Move bulk or marketing mail to a subdomain, such as news.example.com, and give that subdomain its own SPF record.
6. Validate again and send test messages from each service.

How the count works

A record with include:_spf.google.com, include:sendgrid.net and mx has three terms, but the includes contain further includes, so the real total is higher. The validator follows the whole chain and shows the combined count.

Replacing includes with IP ranges

Replacing an include with fixed ip4 and ip6 ranges removes lookups, because those terms cost nothing. The risk is that providers change their addresses, which silently breaks your SPF later. Do this only when the provider publishes stable ranges and you will keep them up to date.

Splitting by subdomain

Each subdomain has its own SPF record and its own limit of 10. Sending marketing mail from news.example.com and transactional mail from mail.example.com spreads the lookups and also protects the reputation of your main domain.

What to avoid

Do not add a second SPF record to get around the limit, because two records cause a permanent error. Avoid the deprecated ptr term, which is slow and counts as a lookup.