SPF PermError: too many DNS lookups
Your SPF record requires more than 10 DNS lookups to evaluate. The receiver stops processing and marks your mail as PermError.
PermError is treated as a hard SPF fail. If your DMARC alignment relies on SPF (not DKIM), you lose DMARC too. Mail increasingly lands in Junk, or gets outright rejected by strict receivers.
What causes it
- Too many include: mechanisms. Every include: fetches its own SPF record, which includes more things recursively.
- Marketing tools accumulated in your SPF record over the years — Google, Microsoft, Salesforce, Zendesk, Mailchimp, SendGrid all stacked.
- An upstream include target added lookups you weren't aware of.
How to fix it
Option 1: Remove senders you don't actually use
Most teams accumulate include: mechanisms for marketing tools they tried once and abandoned. Audit your SPF record and delete any that no longer send on your behalf.
Option 2: Use SPF flattening (carefully)
Services like EasyDMARC, Valimail, and Scrutinize auto-resolve all your include: mechanisms into a static list of IP addresses that fits in one lookup. Downside: when upstream providers rotate IPs, your flat record goes stale. Flattening services re-flatten automatically; manual flattening is a maintenance trap.
Option 3: Delegate to subdomains
Send marketing email from marketing.yourdomain.com with its own SPF record, and transactional from yourdomain.com. Each subdomain gets its own 10-lookup budget.
Fixed it? Run a fresh test to confirm.
Test my inbox →