Why does SPF have a 10 lookup limit?

SPF is evaluated during SMTP delivery, so the standard limits DNS-querying mechanisms to protect receivers from expensive or recursive DNS work.

Do ip4 and ip6 mechanisms count as SPF DNS lookups?

No. Direct ip4 and ip6 mechanisms do not add DNS lookups. Mechanisms such as include, a, mx, ptr, exists, and redirect do.

Is SPF flattening always better?

Not always. Flattening can reduce DNS lookups, but flattened IP ranges can become stale if a provider changes its sending infrastructure.

SPFPROBLEM.comSPF Record Analysis

Common SPF Problems

SPF failures are usually caused by missing senders, invalid record structure, DNS lookup limits, forwarding paths, or policy choices that do not match how the domain actually sends mail.

Problem	What Happens	Typical Cause
No SPF record	SPF returns None	Domain has no SPF TXT record.
Multiple SPF records	SPF returns PermError	More than one v=spf1 TXT record is published.
Sender IP not authorized	SPF returns Fail	The sending server's IP address is not included in the SPF policy.
SoftFail (~all)	Mail may be accepted but marked suspicious	The server is not authorized, but the policy is only a soft fail.
Neutral (?all)	SPF provides no opinion	Rarely used and offers little protection.
PermError	SPF evaluation fails	Syntax errors, multiple records, too many lookups, or invalid mechanisms.
TempError	Temporary failure	DNS timeout or temporary DNS server issue during SPF evaluation.
Too many DNS lookups	SPF returns PermError	The SPF record exceeds the 10 DNS lookup limit for include, a, mx, exists, and redirect.
Excessive MX records	Lookup limit can be exceeded	An mx mechanism expands to many mail servers.
Nested includes	Lookup limit can be exceeded	Includes reference other includes until the SPF lookup budget is exhausted.
Invalid syntax	SPF returns PermError	Missing spaces, malformed mechanisms, invalid qualifiers, or copy/paste errors.
Broken include	PermError or unexpected result	An included domain has no SPF record or publishes an invalid SPF record.
Missing include	Legitimate mail can fail SPF	A third-party sender such as a CRM, helpdesk, or marketing platform has not been authorized.
Using +all	Everyone passes SPF	This effectively defeats SPF and should almost never be used.
Record too long	Record can be hard to publish correctly	TXT data may exceed practical DNS size limits or be split incorrectly.
Incorrect redirect	Unexpected results	The redirect= modifier is misused, duplicated, or mixed with later mechanisms.
IPv6 missing	IPv6 mail can fail SPF	Only IPv4 addresses are authorized even though outbound mail may use IPv6.
Wrong HELO/EHLO SPF	Some receivers may reject mail	The SMTP HELO identity has no valid SPF when checked separately.
Envelope sender differs	SPF appears to fail unexpectedly	SPF checks the envelope sender or Return-Path, not the visible From address.
Forwarded email	SPF often fails	The forwarder sends from its own IP address, which is not authorized by the original sender.
Mailing lists	SPF can fail after remailing	The list resends the message from different infrastructure.
Cloud email forwarding	SPF fails after forwarding	The service forwards mail without rewriting the envelope sender.
DNS propagation	Intermittent results	Some resolvers still have an old SPF answer cached.
Incorrect CIDR range	Some senders fail	The IP range does not cover all outbound mail servers.
Dynamic sender IPs	Random SPF failures	Mail is sent from changing IP addresses not covered by SPF.
Stale SPF	A new provider cannot send successfully	SPF was not updated after changing or adding email providers.
Macro misuse	Unexpected SPF behavior	SPF macros such as %{i}, %{s}, or %{d} are used incorrectly.
DNSSEC or DNS failures	SPF can return TempError	The resolver cannot retrieve the SPF record reliably.

A problem can be a hard error, a temporary DNS condition, or a policy warning. The safest fix is to confirm the real sending services first, then update the SPF record deliberately.

Best Practices

Publish exactly one SPF record for the domain.
Stay within the 10 DNS lookup limit.
End with -all if you are confident every legitimate sender is authorized, or ~all while migrating.
Regularly review and remove obsolete include statements.
Test from multiple DNS resolvers, such as authoritative nameservers, public resolvers, and the likely recipient perspective.
Remember that SPF authenticates the envelope sender or Return-Path, not the visible From address. For full domain authentication, use SPF alongside DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting, and Conformance (DMARC).

For an SPF checking tool, these issues can be grouped into categories such as Record Errors, Policy Errors, Lookup Errors, DNS Errors, Forwarding Issues, Third-Party Sender Issues, and Best Practice Warnings.