DNS lookup limit

What DNS lookup limit means

The DNS lookup limit is RFC 7208's cap of ten on the queries a single SPF evaluation may perform. The mechanisms that count against it are include, a, mx, ptr and exists, together with the redirect modifier; ip4, ip6 and all cost nothing, because they resolve nothing. The count is cumulative across every include, so a provider whose record contains three includes of its own spends four of your ten.

Two smaller limits sit beside it. An mx or ptr mechanism that returns more than ten records is a permerror on its own. And no more than two void lookups — queries answered with NXDOMAIN or an empty answer — are permitted, which is how a decommissioned include quietly breaks a record that has not otherwise changed.

Exceeding the limit is not a soft failure. The evaluation returns permerror, DMARC treats that as an SPF failure, and a domain at p=reject can begin rejecting its own mail on the day one of its senders adds an include to their published record. Flattening — replacing includes with the ip4 and ip6 ranges they currently resolve to — trades the limit for a maintenance burden, because those ranges change and nothing announces it. Removing senders you no longer use is the cheaper fix.