Network & Security Published by

SPF Lookup Limit: A Safe Way to Diagnose PermError

Diagnose SPF's ten-lookup limit by following nested includes, recording evidence and changing one sender dependency at a time.

An SPF record can look short and still fail during evaluation. The important number is not how many mechanisms you see in the root TXT record: it is how many DNS-querying terms a receiver evaluates, including terms reached through nested include: or redirect= statements.

RFC 7208, section 4.6.4 sets the relevant lookup limit at ten. A receiver that exceeds it returns permerror. This is different from a simple mismatch between a sending IP and an authorized range.

First, confirm the symptom

  1. Record the exact domain being used in the envelope MAIL FROM / Return-Path, not only the visible From address.
  2. Query its public TXT records and identify the SPF record beginning v=spf1.
  3. Follow every relevant include: and redirect= dependency; include nested dependencies in the count.
  4. Note the lookup chain that triggers the error. Also record DNS failures, multiple SPF records and malformed syntax separately.
  5. Compare the finding with the actual mail provider’s sending-domain configuration.

A common trap: counting all mechanisms without regard to which branch is actually evaluated. SPF evaluation is ordered; the mechanism matching path matters, and ip4 or ip6 terms do not consume the same DNS-lookup budget as include or a.

Change policy without breaking mail

Build an inventory of legitimate services sending on behalf of the domain. Find obsolete entries first. If a third-party sender supports a dedicated subdomain, that may be safer than adding another include to an already crowded root record. Do not flatten everything into static IP lists without an update owner: providers change their address ranges.

After every edit, confirm DNS propagation, send a controlled test message from each expected provider, inspect Authentication-Results, and retain a rollback copy. SPF alone does not establish DMARC alignment; evaluate DKIM and DMARC separately.

Where to go next

Use the NexKit SPF checker to inspect public records and compare the result with your own mail logs. For primary-source behavior, read RFC 7208; for a population-level example, see our SPF lookup research.

Scope: This is a diagnostic workflow, not a claim that a public DNS inspection proves delivery success.