Your SPF record needs more than 10 DNS lookups to check, and 10 is the limit. Past it, the SPF check returns an error instead of a pass, so your email can fail authentication. Count the include:, a, mx, ptr, exists and redirect parts, including those inside each include, and remove the services you no longer send from.
What's the problem
An SPF checker reports "too many DNS lookups" or "PermError", or your email fails SPF even though your sending services are listed.
Why it happens
- Every email service you add puts another
include:in the record, and each include can contain more lookups of its own. - Old services are never removed after you stop using them.
a,mxandptrparts also count toward the 10.
How to fix it
- List what's in the record: look up the TXT record starting
v=spf1on your domain. - Remove includes for services you don't send from anymore.
- Remove
aormxif those servers don't send mail. - If you still need more, send bulk or marketing mail from a subdomain with its own SPF record.
- Check again that the total is 10 or fewer and that there is only one
v=spf1record.
What Preventionlabs checks
One click runs the full report on your domain. For this problem it shows your email authentication: SPF (and its 10-lookup limit), DMARC and DKIM; whether mail to you must arrive encrypted (MTA-STS) and whether you get reports when it does not; your DNS: nameservers, addresses, DNSSEC, and records pointing at services that no longer exist. It can't see your sending provider's delivery logs, so check bounces there.
Run your free reportYour first report is free, no card needed. Then A$50 a month, up to 10 domains. Read-only: it never changes anything.