emailmetry
All guides

The SPF lookup limit

Emailmetry guideReviewed

An SPF record can be short and still exceed the ten-lookup limit. Records referenced by your providers count too, so the includes you see in your own record are only the starting point.

SummaryThe limit includes DNS lookups triggered by nested SPF records. Counting the includes in your own record is not enough.

In this guide

What the limit actually counts

During an SPF check, a receiver can evaluate at most ten terms that require DNS lookups: include, a, mx, ptr, exists and redirect. Going over the limit returns permerror, meaning the policy could not be evaluated correctly. Cached answers still count towards this limit. SPF also has separate limits for address expansion and empty DNS answers. SPF standard, DNS lookup limits.

Rules containing IP addresses (ip4 and ip6) and the all rule do not use these ten lookups. Fetching the initial SPF record does not count as an extra term either.

One include can lead to another

Your newsletter provider’s SPF record might include a delivery service, whose record includes a regional service. Each include counts if the receiver evaluates it. NCSC’s SPF configuration guide.

  1. 1
    include:newsletter.exampleYour record includes the newsletter provider.
  2. 2
    include:delivery.exampleThe newsletter provider includes its delivery service.
  3. 3
    include:region.exampleThe delivery service includes a regional record.
This example uses three of the ten terms if all three includes are evaluated. Other rules in the record can add more. The .example domains are placeholders.

The count can differ between senders. One IP address may match an early rule, while another requires the receiver to check more of the record. When using a checker, look for whether it reports a possible maximum or the count for a specific sending IP.

Splitting the record does not reset the limit

Putting the same rules into a new included record still counts towards the limit. Splitting a TXT value into several text strings does not change the count either.

Check which services you need

  1. Follow the includes. Check the records your domain references, including their nested records. Note when you checked them, because providers can change DNS.
  2. Identify each service. Find out what an unfamiliar include is used for before removing it. It could belong to billing software or a website form.
  3. Read the provider’s instructions. Confirm the right SPF settings for your account and sending domain.
  4. Check the proposed record. Preserve the services still in use, then test their email after making a change.

Download email service list template (CSV) to keep the services and their settings in one place.

How Emailmetry reduces lookups

SPF flattening replaces supported provider references with IP address rules. Those rules let a receiver check sending addresses without following the same chain of DNS lookups. Emailmetry checks that the flattened record preserves the supported source rules, including their pass, fail, softfail and neutral results.

Providers change their sending addresses, so a copied list of IPs can become outdated. Emailmetry follows those changes automatically and checks updates before publishing them. Add your domain, select your sending services and add the DNS record Emailmetry provides.

Some SPF features cannot be flattened by Emailmetry: ptr, exists and macros in domain names. These are rejected rather than converted. An original record that exceeds the lookup limit still returns permerror when evaluated; producing a flattened version does not make that original record valid. See Emailmetry’s SPF checks for the supported scope.