Back to Learn
email
March 2026

How many SPF DNS lookups are allowed?

SPF allows a maximum of 10 DNS lookups. Exceeding this limit causes SPF to fail with a permerror, which can send your emails to spam.

Detailed Answer

The SPF specification (RFC 7208) limits DNS lookups to 10 per SPF evaluation. This is one of the most common causes of SPF failures.

What counts as a lookup:

  • include: — 1 lookup (plus any lookups in the included record)
  • a: — 1 lookup
  • mx: — 1 lookup (plus 1 per MX record for A resolution)
  • redirect= — 1 lookup
  • exists: — 1 lookup

What does NOT count:

  • ip4: — no lookup needed
  • ip6: — no lookup needed
  • all — no lookup needed

Common services and their lookup cost: | Service | Typical lookups | |---------|----------------| | Google Workspace | 3-4 lookups | | Microsoft 365 | 2-3 lookups | | Mailchimp | 1 lookup | | SendGrid | 1 lookup | | Salesforce | 2-3 lookups |

Example problem: Google Workspace (4) + Microsoft 365 (3) + SendGrid (1) + Mailchimp (1) + Salesforce (2) = 11 lookups → SPF FAILS

How to fix:

  1. Use ip4: and ip6: instead of include: where possible
  2. Remove unused services from your SPF record
  3. Use SPF flattening (merge includes into IP addresses)
  4. Consider separate sending domains for different services

Check your SPF lookup count: https://intodns.ai (scan your domain and look at the SPF section) Generate an optimized SPF record: https://intodns.ai/tools/spf-generator

Check your domain now

Use IntoDNS.ai to scan your domain and get instant email insights.

Scan Your Domain

Related Questions

How to setup an SPF record?

Create a DNS TXT record at your root domain with format: v=spf1 include:_spf.google.com ~all

What is SPF, DKIM, and DMARC?

SPF, DKIM, and DMARC are email authentication standards that verify sender identity and prevent email spoofing.

Why do my emails go to spam?

Emails go to spam when missing SPF, DKIM, or DMARC authentication, or when sent from blacklisted servers.

How IntoDNS.ai evaluates this →