# SPF: spf=permerror — Too many DNS lookups (limit is 10)

**Code:** `SPF PermError: too many DNS lookups` · **Category:** Email / SMTP · **Seen on:** SMTP, Linux

Your SPF record needs more than 10 DNS lookups to evaluate, so receivers treat SPF as a permanent error and the check fails.

## Meaning

SPF allows at most 10 mechanisms that trigger lookups (`include`, `a`, `mx`, `ptr`, `exists`, `redirect`). Each included service adds lookups, often nested. Flatten the record, remove unused services, replace `include` with `ip4`/`ip6` where IPs are stable, or use a subdomain per service.

## Common causes

- Many `include:` entries (Google, Microsoft, SendGrid, Mailchimp, CRM…)
- Nested includes by those providers
- Use of `mx`, `a` and `ptr` mechanisms
- Old services never removed
- Multiple tools each asking you to add an include

## Quick fix

1. Count lookups with an SPF checker (dmarcian, MXToolbox)
2. Remove unused includes and convert stable ones to ip4/ip6
3. Use SPF flattening or separate subdomains per sender

## Detailed fix by platform

### Linux

1. `dig +short TXT example.com | grep spf1` and `dig +short TXT _spf.google.com` to expand includes by hand

## Code examples

### A trimmed record

```bash
# before: v=spf1 include:_spf.google.com include:sendgrid.net include:servers.mcsv.net include:spf.protection.outlook.com ~all
# after (unused services removed, stable IPs inlined)
example.com. IN TXT "v=spf1 include:_spf.google.com ip4:198.51.100.0/24 -all"
```

## How to diagnose

1. **Lookups** — Count above 10?
2. **Includes** — Which are unused?
3. **Subdomains** — Can senders be split?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/email/spf-permerror-too-many-lookups)