How to Fix "Too Many DNS Lookups" in Your SPF Record

What you will need: Login access to wherever your domain's DNS is managed (usually your domain registrar or web host), and about 30 minutes.

If our Email Setup Check told you your SPF record has "too many lookups," this guide walks you through fixing it.

What this means

SPF (Sender Policy Framework) is a list, stored in your domain's DNS settings, of the services allowed to send email as you. DNS is the internet's address book, where settings for your domain live. When a receiving mail server gets a message from you, it checks that list to see if the sender is approved.

The SPF standard limits that check to 10 DNS lookups. A lookup is each time the receiving server has to ask DNS for more information to finish reading your list.

These count toward the limit:

• include: (borrows another service's list, and any lookups inside that list count too)
• a
• mx
• ptr
• exists
• redirect

These do not count:

• ip4: and ip6: (a plain IP address)
• all (the ending, such as ~all or -all)

Going over 10 makes your SPF record invalid (an error called a "permerror"), so SPF can't pass for any of your email. Your legitimate mail is then more likely to be flagged as suspicious. Our spam guide, why your business emails land in spam and how to fix it, covers the bigger picture.

The Email Setup Check shows a warning at 8–10 lookups ("close to the limit") and a failure above 10.

First rule: only one SPF record

Your domain must have one SPF record, meaning one DNS entry that starts with v=spf1. If you have two, SPF breaks entirely.

If you find two, merge them into one. For example, these two entries:

v=spf1 include:_spf.mailhost.example ~all
v=spf1 include:spf.newsletter.example ~all

become one:

v=spf1 include:_spf.mailhost.example include:spf.newsletter.example ~all

Keep a single all at the end.

Step 1: Take inventory

1. Run the Email Setup Check on your domain.
2. Click Show technical details on the SPF card to see your current record.
3. Copy the record into a document so you have a backup before changing anything.
4. List every include: in the record and write down which service it belongs to (your email host, newsletter tool, invoicing software, and so on).

If you can't tell what an include: belongs to, the domain name after it often hints at the company. Don't delete anything you can't identify yet. Ask your team or the service's support first.

Step 2: Remove what you no longer use

This is the most common fix, and the safest. Look for:

• An old email host you've moved away from
• A newsletter or marketing tool you've cancelled
• A trial of a service you never adopted

For each one that's truly gone, delete its include: from the record. Before removing anything, confirm with your team that nobody still sends email through that service. Removing a service that is still in use means its messages may start failing SPF.

Step 3: Check whether DKIM can do the job instead

DKIM is a digital signature added to your outgoing email, which proves the message wasn't altered and really came from your domain. Many services let you set up DKIM on your domain through a few DNS entries.

DMARC is the policy that tells receivers what to do with mail that fails authentication. For DMARC, a message needs to pass either SPF or DKIM (with the domain matching yours), not both.

That means a service that reliably signs with DKIM on your domain may not need to be in your SPF record at all. To try this:

1. Open the service's settings and look for "domain authentication," "DKIM," or "sender verification."
2. Add the DNS entries it gives you.
3. Confirm the service reports DKIM as verified.
4. Send a test message and check that it shows a DKIM pass.
5. Only then consider removing that service's include: from SPF.

Not every service supports this, so check before you remove anything.

Step 4: Send bulk mail from a subdomain

A subdomain is a prefix on your domain, like news.example.com. SPF is checked per domain name, so a subdomain can have its own SPF record with its own 10-lookup budget.

If a newsletter or marketing tool takes up many of your lookups, you can:

1. Set up the tool to send from something like news.example.com. Its help pages should explain how.
2. Create a separate SPF record for news.example.com containing only that tool's include:.
3. Remove that tool's include: from your main domain's record.

Your day-to-day mail stays on the main domain, and bulk mail has its own space. This also keeps a problem with bulk mail from affecting your regular business email.

Step 5: Flattening (last resort only)

Flattening means replacing include: entries with the raw IP addresses behind them. Since IP addresses don't count toward the limit, the lookup count drops.

The risk is that email providers can change their IP addresses. If you flatten by hand, your record keeps listing the old addresses. Your mail can then start failing SPF without any error or warning.

Because of that:

• Try Steps 2–4 first.
• Never flatten by hand.
• If you must flatten, use a service that automatically keeps the IP list current, and make sure you understand how it does that before you commit.

Before and after

Here is an example for example.com. The lookup numbers are made up for illustration; real services vary.

Before:

v=spf1 include:_spf.mailhost.example include:spf.newsletter.example include:spf.oldhost.example include:spf.invoicing.example mx a ~all

Entry	Lookups (illustrative)
include:_spf.mailhost.example	3
include:spf.newsletter.example	4
include:spf.oldhost.example	3
include:spf.invoicing.example	2
mx	1
a	1
Total	14 (over the limit)

What we changed:

• Removed spf.oldhost.example (the old email host was cancelled).
• Moved the newsletter tool to news.example.com, with its own SPF record.

After, for example.com:

v=spf1 include:_spf.mailhost.example include:spf.invoicing.example mx a ~all

That's 3 + 2 + 1 + 1 = 7 lookups.

New record for news.example.com:

v=spf1 include:spf.newsletter.example ~all

How to make the change

1. Log in to wherever your DNS is managed.
2. Find the TXT record (a DNS entry that holds text) that starts with v=spf1.
3. Replace its contents with your updated record. Edit the existing one rather than adding a second.
4. Save. DNS changes can take some time to show up everywhere, so wait a bit before testing.

Check your work

1. Re-run the Email Setup Check.
2. Open the SPF card and confirm the lookup count is 10 or fewer, ideally 8 or fewer so you have room to add a service later.
3. Confirm you still see only one SPF record.
4. Send a test message from each service you still use, and make sure it arrives normally.

If you'd like a hand with any of this, use the "Get help with this" button on your results or our contact form, and we'll be glad to help.