SPF too many DNS lookups? Count every include

SPF fails when a record needs more than 10 DNS lookups, and the includes' own lookups count. Type your domain to count the whole tree and see which include to cut.

What the 10-lookup limit is #

When a receiver checks SPF, six kinds of term make it ask DNS something: the include, a, mx, ptr and exists mechanisms and the redirect modifier. SPF allows 10 of them in one check, and past 10 the result is permerror. [1] The limit covers the whole check, not each record, so every term inside every include counts. [1]

The ip4, ip6 and all mechanisms cost nothing, and neither does exp. [1] A record that lists only addresses needs no lookups at all.

include:

Costs a lookup?: Yes, plus everything in the record it points to

Notes: If that domain has no SPF record, SPF fails with permerror. [1]

redirect=

Costs a lookup?: Yes, plus everything in the target

Notes: Ignored when the record has an all anywhere. [1]

a, mx

Costs a lookup?: Yes, one each

Notes: Each MX found may lead to at most 10 address lookups, or mx fails. [1]

exists:

Costs a lookup?: Yes

Notes: Often used with macros by large senders.

ptr

Costs a lookup?: Yes

Notes: SPF's own standard says not to publish it. [1]

ip4:, ip6:, all

Costs a lookup?: No

Notes:

What common includes cost #

Counted with the tool above on November 4, 2026. Senders change their records, so count again before you rely on a number.

include:_spf.mx.cloudflare.net

Used for: Cloudflare Email Routing and Email Sending

Lookups: 1

include:_spf.google.com

Used for: Google Workspace

Lookups: 1

include:spf.protection.outlook.com

Used for: Microsoft 365

Lookups: 1

include:amazonses.com

Used for: Amazon SES

Lookups: 1

include:servers.mcsv.net

Used for: Mailchimp

Lookups: 1

include:spf.mtasv.net

Used for: Postmark

Lookups: 1

include:spf.brevo.com

Used for: Brevo

Lookups: 1

include:sendgrid.net

Used for: SendGrid

Lookups: 2

include:_spf.salesforce.com

Used for: Salesforce

Lookups: 2

include:mailgun.org

Used for: Mailgun

Lookups: 5

include:zoho.com

Used for: Zoho Mail

Lookups: 5

So Cloudflare, Google Workspace and a newsletter tool together cost 3. Two of the five-lookup includes and a couple of others are enough to go over.

How to get back under 10 #

1. 1Remove senders you no longer use. An old newsletter tool or CRM is the usual culprit, and each include you drop takes all of its lookups with it.
2. 2Drop `a`, `mx` and `ptr` unless those servers really send mail. They're often in the record by default. If your website's server doesn't send mail, a can go.
3. 3Send from a subdomain. Bulk mail from news.example.com gets its own SPF record and its own 10 lookups, and your main domain's record stays small.
4. 4Replace an include with the addresses, carefully. Listing a sender's ip4: ranges costs nothing, but the sender can change them without telling you, and mail from new addresses fails. Only do it for senders that publish fixed ranges.

Other SPF errors the count finds #

• An include with no SPF record. The sender moved or closed, and the include now fails SPF for everything. [1]
• Two SPF records on one domain. That's a permanent error too. Merge them, as shown in SPF, DKIM and DMARC on Cloudflare.
• A loop. Two records that include each other never finish.

Where Ayoh fits #

Ayoh sends through Cloudflare Email Service, so it needs only Cloudflare's include, one lookup. When you connect a domain, Ayoh adds it to the SPF record you have instead of creating a second one.

Sources #

Read November 4, 2026.

• [1] IETF, RFC 7208, SPF (opens in a new tab): the terms that cost a lookup and the limit of 10 (section 4.6.4), an include with no record (section 5.2), ptr (section 5.5) and redirect with all (section 6.1).