webzod
account

Bring the SPF record under 10 DNS lookups

email.spf.too_many_lookups · effort: about an hour

Why it matters

SPF allows at most 10 DNS lookups across the record and everything it includes, and beyond that receivers return a permanent error, so SPF fails for every sender. This is easy to hit when several mail services each add their own include.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Count what costs a lookup: include, a, mx, ptr, exists and redirect each count, and so does everything they pull in. ip4, ip6 and all are free.
  2. First remove what you no longer use: old providers, retired newsletter tools, a, mx or ptr terms that nothing needs. This is the safest fix and often enough.
  3. Next move bulk or marketing mail to its own sending subdomain (for example news.yourdomain), each subdomain with its own SPF record and its own 10 lookups. Ask the provider to send from that subdomain.
  4. Replacing an include with the provider's IP addresses by hand (flattening) saves lookups but is risky: providers change their addresses without telling you, the copied list goes stale, and legitimate mail starts failing SPF silently. Only do it with a service that keeps the flattened record updated for you, or ask the provider whether it offers a hosted or flattened SPF record.
  5. Re-scan after each change and check DMARC reports for failing legitimate mail.
  6. Until this is fixed, DMARC can still pass through DKIM alone, so check that each sender signs with a key for your domain. If your DMARC record has aspf=s (strict SPF alignment), mail from a sender using a subdomain as its envelope address will not align with SPF either, so DKIM matters even more.
dns 
; Main domain keeps only the senders it really uses
example.com.  IN TXT  "v=spf1 include:_spf.MAIN-PROVIDER.example ~all"
; Marketing or bulk mail moves to its own subdomain with its own lookup budget
news.example.com.  IN TXT  "v=spf1 include:_spf.MARKETING-PROVIDER.example ~all"

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.