Your cold emails land in spam, you check your domain and a tool tells you: "SPF record has too many DNS lookups". This is one of the most common email authentication problems, and it is easy to fix once you know what is being counted.
What the 10 lookup limit means
SPF lets you list every service that may send email for your domain. When a receiving server checks your SPF record, it may have to ask DNS for more information. The SPF standard (RFC 7208) allows at most 10 of these DNS lookups per check. Go over the limit and the check ends with a permanent error, which many receivers treat as an SPF failure.
What counts as a lookup
| Item in your SPF record | Counts as a lookup? |
|---|---|
include: | Yes |
a and mx | Yes |
exists: and redirect= | Yes |
ptr | Yes (and you should not use it) |
ip4: and ip6: | No |
all | No |
The tricky part is that lookups are nested. One include: can contain several more include: entries inside it, so a single line in your record can cost three or four lookups on its own.
How to count your lookups
Paste your domain into our SPF Record Checker. It follows every include and shows the total, so you can see which service uses the most.
Four ways to get under the limit
- Remove services you no longer use. Old newsletter tools, past CRMs and trial accounts are the most common cause. If you do not send from it anymore, delete the include.
- Replace stable services with IP addresses. If a sender uses fixed IPs,
ip4:entries cost nothing. Only do this when the provider promises that the addresses do not change. - Split senders across subdomains. Send cold email from a subdomain such as
mail.yourdomain.comand give it its own SPF record. Each subdomain gets its own limit of 10. - Use SPF flattening carefully. Flattening turns includes into IP lists, but providers change their IPs. If you flatten, use a service that updates the record automatically.
Build a clean record
Use the SPF Record Generator to pick only the services you need. A tidy record looks like this:
v=spf1 include:_spf.google.com include:sendgrid.net ~allStart with ~all while you are testing and move to -all once every sender is listed.
Check your work
After you publish the new record, wait a few minutes and run the Domain Scanner. It checks SPF, DKIM and DMARC together, so you can confirm the whole setup is healthy.
Tip: Keep only one SPF record per domain. Two separate SPF records cause a different error and break SPF completely.
