•RFC 7208RFC 7208 SPECIFICATION•10-LOOKUP GUARD10-LOOKUP CEILING GUARD
RFC 7208 SPF 10-Lookup Counter
Evaluate SPF include trees, count DNS query limits (10-lookup ceiling), and prevent mail delivery PermError failures.
// SPECIFICATION & GUIDANCE
Frequently Asked Questions: SPF 10-Lookup Limit & PermError
Authoritative technical reference on RFC 7208 DNS query boundaries, mail server PermError behavior, and email authentication hygiene.
RFC 7208 Section 4.6.4 dictates that receiving mail transfer agents (MTAs) must not perform more than 10 DNS lookups when evaluating an SPF authorization policy. If evaluating an SPF record requires more than 10 DNS queries, evaluation terminates immediately and returns an SPF PermError (Permanent Error).
Mechanisms that consume one or more lookups against your 10-query budget are: include:, a, mx, ptr, exists, and redirect=. Conversely, ip4:, ip6:, and all do NOT consume lookups because their IP addresses or modifiers are resolved directly in the initial TXT query without recursive DNS traversal.
When your SPF include tree breaches 10 lookups, receiving mail filters (like Google Workspace, Microsoft 365, and Yahoo Mail) evaluate the message as an SPF PermError. Under strict DMARC policies (p=reject or p=quarantine), this causes legitimate outbound emails from transactional and marketing services to be rejected or routed straight to spam.
Third-party SaaS services often use nested SPF includes. For example, include:_spf.google.com triggers 3 lookups internally (_netblocks.google.com, _netblocks2.google.com, _netblocks3.google.com). Combining Google with Zendesk, SendGrid, and HubSpot quickly pushes the total lookup count to 8, 9, or beyond 10.
To eliminate an SPF 10-lookup PermError: (1) Audit and remove deprecated SaaS vendors and old marketing platforms; (2) Segregate email traffic across dedicated subdomains (e.g. mail.yourcompany.com for marketing, transactional.yourcompany.com for receipts); or (3) Flatten dynamic include: mechanisms into resolved ip4: and ip6: CIDR ranges.
// EMAIL PROVIDER GUIDES