An SPF record tells other mail servers which sources are allowed to send email for your domain. If you keep adding third-party services (an email marketing platform, a CRM, a helpdesk, Google Workspace or Microsoft 365) each one usually adds an include: line to that record, and each of those lines can trigger its own DNS lookup behind the scenes. Once your SPF record needs more than 10 of these lookups to fully resolve, it fails with what's called a "permerror," and receiving mail servers may treat your messages as unauthenticated, no matter how correct the rest of your setup is.
What Causes This Error
The SPF standard limits a record to 10 DNS lookups during evaluation. Certain mechanisms count toward that limit: include, a, mx, ptr, and exists. The common culprit is a long chain of include: entries added over time, one for every tool that's ever been allowed to send mail on your behalf, including services you may have stopped using years ago.
Some of those included records also nest further lookups inside them, so a handful of include: entries can quietly add up to well over 10 without the record looking unusually long.
How to Check If This Is Affecting You
- Search for an online SPF record checker and enter your domain name. A compliant checker will show you the total lookup count and flag it if you're over the limit.
- Alternatively, if you're comfortable with the command line, run nslookup -type=txt yourdomain.com (or the equivalent on your system) and read through the record manually, counting each include:, a, mx, and exists mechanism.
- If you're not sure how to read the result, open a support ticket and our team can check the record for you.
A permerror from too many lookups doesn't always block mail outright. Some receiving servers reject it, others silently lower your sender reputation. Either way, it's worth fixing even if your mail still seems to be arriving.
How to Fix It
Remove services you no longer use
Go through each include: entry and confirm the service is still actually sending mail for your domain. It's common to find an old marketing tool or a trial account that was never removed. Deleting unused entries is the fastest way to bring the count back under the limit.
Consolidate where you can
If you use several products from the same provider, check whether they share one combined SPF include rather than needing a separate line for each. Providers often document a single recommended include for all their sending services.
Avoid unnecessary a and mx mechanisms
If your SPF record still has an a or mx mechanism left over from an old setup and your website doesn't send mail directly, it can usually be removed without affecting delivery.
Flatten the record only as a last resort
Some providers offer SPF "flattening," which resolves includes into static IP addresses so they stop counting as separate lookups. This works but needs to be re-checked periodically, since a provider's underlying IPs can change and a stale flattened record will silently stop authorizing mail from them. Only do this if trimming and consolidating isn't enough.
How to Update Your SPF Record
Your SPF record lives as a single TXT record on your domain, usually starting with v=spf1. Once you know what the corrected record should say, update it as follows.
In cPanel
- Log in to cPanel and open Zone Editor under the Domains section.
- Find your domain and click Manage.
- Locate the existing TXT record that contains v=spf1 and click Edit.
- Replace the record's content with your corrected SPF string and click Save Record.
In DirectAdmin
- Log in to DirectAdmin and open DNS Management (sometimes labeled DNS Administration).
- Select your domain from the list.
- Find the TXT record containing v=spf1, click to edit it, and replace it with your corrected SPF string.
- Click Save to apply the change.
Only keep one SPF record per domain. If you have more than one TXT record starting with v=spf1, that alone will cause receiving servers to reject the record as invalid. Merge them into a single line instead.
Changes to a TXT record aren't instant everywhere: give it a few hours to propagate before re-running a checker to confirm the lookup count is now under 10.
If you haven't set up SPF and DKIM at all yet, see How to Set Up SPF and DKIM Records to Stop Your Emails Going to Spam first.