SPF PermError: too many DNS lookups Email / SMTP Origin: Network Last updated 4 Nov 2026

SPF: spf=permerror — Too many DNS lookups (limit is 10)

Your SPF record needs more than 10 DNS lookups to evaluate, so receivers treat SPF as a permanent error and the check fails.

Exact message you may see spf=permerror Too many DNS lookupsSPF PermError too many DNS lookupspermerror: too many DNS lookupsspf permerror (limit is 10)Received-SPF: PermError
Explore the map of this error Full error map →
Seen on: SMTP Linux

Meaning

SPF allows at most 10 mechanisms that trigger lookups (include, a, mx, ptr, exists, redirect). Each included service adds lookups, often nested. Flatten the record, remove unused services, replace include with ip4/ip6 where IPs are stable, or use a subdomain per service.

Common causes

  • Many include: entries (Google, Microsoft, SendGrid, Mailchimp, CRM…)
  • Nested includes by those providers
  • Use of mx, a and ptr mechanisms
  • Old services never removed
  • Multiple tools each asking you to add an include

⚡ Quick fix

  1. Count lookups with an SPF checker (dmarcian, MXToolbox)
  2. Remove unused includes and convert stable ones to ip4/ip6
  3. Use SPF flattening or separate subdomains per sender

Detailed fix by platform

Linux

  1. dig +short TXT example.com | grep spf1 and dig +short TXT _spf.google.com to expand includes by hand

Code examples

A trimmed record

bash
# before: v=spf1 include:_spf.google.com include:sendgrid.net include:servers.mcsv.net include:spf.protection.outlook.com ~all
# after (unused services removed, stable IPs inlined)
example.com. IN TXT "v=spf1 include:_spf.google.com ip4:198.51.100.0/24 -all"

How to diagnose

  1. Lookups — Count above 10?
  2. Includes — Which are unused?
  3. Subdomains — Can senders be split?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

421 4.7.0 Try again later (rate limited) — SMTP: 421 4.7.0 Our system has detected an unusual rate of unsolicited mail originating from your IP address. Mail sent from your IP address has been temporarily rate limited (Email / SMTP)421 4.7.0 Try again l…550 5.7.25 PTR record required — SMTP: 550-5.7.25 The IP address sending this message does not have a PTR record setup, or the corresponding forward DNS entry does not point to the sending IP (Email / SMTP)550 5.7.25 PTR record…550 5.7.26 — 550 5.7.26 This mail has been blocked because the sender is unauthenticated (SPF/DKIM/DMARC) (Email / SMTP)550 5.7.26DKIM: no key for signature — DKIM: dkim=permerror (no key for signature) / key not found in DNS selector._domainkey (Email / SMTP)DKIM: no key for sign…DMARC fail: SPF and DKIM not aligned — DMARC: dmarc=fail (p=REJECT) — SPF and DKIM pass but domains are not aligned with the From header (Email / SMTP)DMARC fail: SPF and D…DMARC: no record found — DMARC: dmarc=none (no DMARC record found for example.com) — bulk sender requirements not met (Email / SMTP)DMARC: no record foundSPF fail / softfail: sender IP not authorized — SPF: Received-SPF: softfail (google.com: domain of transitioning bounce@example.com does not designate 203.0.113.5 as permitted sender) (Email / SMTP)SPF fail / softfail: …SPF: multiple SPF records — SPF: spf=permerror — Multiple SPF records found for example.com (Email / SMTP)SPF: multiple SPF rec…SPF PermE…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.