My SPF record has too many lookups.

Why the limit exists and what it breaks

SPF allows a maximum of ten DNS lookups when a receiving server evaluates it. Every include, a, mx, exists and redirect counts, and so does every lookup inside the records you include.

Cross the limit and the evaluation returns a permanent error. Most receivers treat that as no SPF at all. If you also run DMARC at quarantine or reject, your own mail starts failing.

How it happens

Nobody adds six senders at once. A tool gets added, then another a year later, then a marketing platform, then a help desk. Each addition is small and correct, and one of them is the one that crosses the line.

Bring it back under the limit

• Remove senders you no longer use. Almost every over-limit record contains at least one tool nobody has used in two years. This alone often fixes it.
• Use narrower includes. Some providers publish a specific include for transactional mail rather than their whole platform.
• Replace includes with IP ranges where a sender publishes stable addresses. An ip4: entry costs no lookup.
• Consider flattening, which resolves the includes into raw addresses. It works, but the addresses change without notice and it will break unless something keeps it updated.
• Move separate sending onto a subdomain. Marketing mail from mail.yourdomain.com gets its own SPF record and its own budget of ten.

How to know you have crossed it

You will not, from the outside. The record looks right in every listing. It needs a check that counts the lookups by following each include, which is what the free mail check does.

If you have no SPF record at all, start here instead.

The short version of everything about SPF is in the SPF field guide.