SPF lookup limit
The rule that one SPF check may involve at most ten mechanisms or modifiers that need DNS queries; exceeding it returns permerror.
What it means
RFC 7208 caps the terms that cause DNS queries during one evaluation at ten: include, a, mx, ptr, exists and redirect. ip4, ip6 and all are free, and exp is looked up only after a fail. The count runs across nested records, so an include whose target holds four more includes costs five. Going past ten produces permerror, and DMARC then gets no SPF pass from the record.
There are further caps: each mx or ptr may lead to no more than ten address lookups, and receivers should stop after two void lookups.
The usual causes are stacking many sending services in one record and providers whose own records use several lookups. Fixes: remove services no longer used, move a service onto its own subdomain with its own record, or replace includes with addresses (flattening).
Example
v=spf1 include:a.example include:b.example include:c.example ... -all (permerror once the nested total passes 10)Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 7208: Sender Policy Framework (SPF), section 4.6.4rfc-editor.org
- Google Workspace Admin Help: Set up SPFknowledge.workspace.google.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes