--- title: "SPF PermError: How to Count Nested Lookups and Fix the 10-Lookup Limit" description: "How the counting actually works, how to audit your own record with a recursive walk, and three safe ways to get back under the limit." url: https://warminboxes.com/blog/spf-10-lookup-limit-fix breadcrumb: "Home > Blog > SPF PermError: How to Count Nested Lookups and Fix the 10-Lookup Limit" --- [WarmInboxes.com](https://warminboxes.com/) [Offer](https://warminboxes.com/offer) [Free Leads](https://warminboxes.com/leads) [Free Tools](https://warminboxes.com/deliverability-tools) [Blog](https://warminboxes.com/blog) [Reviews](https://warminboxes.com/reviews) [Home](https://warminboxes.com/) › [Blog](https://warminboxes.com/blog) › SPF PermError: How to Count Nested Lookups and Fix the 10-Lookup Limit [Back to Blog](https://warminboxes.com/blog) Technical 5 min read July 19, 2026 # SPF PermError: How to Count Nested Lookups and Fix the 10-Lookup Limit Your SPF record can be syntactically perfect and still silently fail every check, because RFC 7208 caps evaluation at 10 DNS lookups, nested includes count, and going over returns permerror. Here's how the counting actually works, how to audit your own record, and three safe ways to get back under. [Huzayfa Majeed](https://warminboxes.com/authors/huzayfa-majeed) Cold Email Expert · WarmInboxes ![Fixing the SPF 10 DNS lookup limit and permerror]() ## Quick Answer: Count Recursively, Cut Dead Weight First Run your domain through our [SPF Checker](https://warminboxes.com/spf-checker), it recursively resolves every include and shows a numbered lookup tree against the 10-lookup meter. Over the limit? **1) Delete includes for services you no longer use. 2) Move non-critical services to subdomain SPF records (each gets its own budget of 10). 3) Flatten stable providers to ip4 ranges, carefully.** Most over-limit records fix with step 1 alone. ## The Failure Nobody Sees Coming The 10-lookup limit is cold email's most common silent killer because it fails invisibly and arrives gradually. Your record was fine at 6 lookups. Then marketing added HubSpot, support added Zendesk, someone added a second ESP "just to test", and one Tuesday you crossed 10. Nothing errored, no dashboard turned red; receivers just started returning `permerror`, your SPF stopped counting for anything, and placement sagged with no visible cause. The record still *reads* perfectly, syntax checkers pass it, because the problem isn't syntax, it's arithmetic. ## How the Counting Actually Works Worked example, this innocent-looking record costs 9 v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org a mx ~all include:_spf.google.com = 1 └ 3 nested _netblocks includes = 3 (hidden inside Google's record) include:sendgrid.net = 1 └ 1 nested include = 1 include:mailgun.org = 1 a = 1 mx = 1 total = 9 of 10 ← one more service breaks it - •**Cost one each, at every depth:** include, a, mx, ptr, exists, redirect. (ptr is also deprecated, delete it on sight.) - •**Cost zero:** ip4, ip6, all, and the v=spf1 tag itself. - •**The nesting is the trap:** you can't audit by reading your own TXT record, you have to resolve the whole tree, which is why eyeball audits miss it and why our [checker](https://warminboxes.com/spf-checker) walks it recursively and numbers every lookup. - •**Bonus rule, void lookups:** includes pointing at domains with NO SPF record are limited to 2 before permerror. Dead includes hurt twice. ## Fix #1: Delete the Dead Weight (Works More Often Than You'd Think) Audit every include against reality: are you actually still sending through that service, from this domain? Old ESP trials, a switched marketing platform, a survey tool from 2023, records accumulate includes like garages accumulate boxes. Each deletion refunds its whole subtree. Most over-limit records we see fix entirely at this step, and the discipline that keeps them fixed is treating the SPF record as an allowlist you own, not a guestbook anyone can sign. ## Fix #2: Split by Subdomain (The Structural Fix) Each domain and subdomain evaluates its own SPF with its own 10-lookup budget. So move services to where they belong: marketing platform sends from `news.yourco.com` with its own SPF, support tool from `help.yourco.com`, and your root (or better, your [separate sending domains](https://warminboxes.com/blog/subdomain-vs-separate-domain-cold-email)) carries only what actually sends there. Cold email sending domains done right need just one or two includes, their budget is never the problem; it's shared multi-purpose domains that overflow. ## Fix #3: Flatten, Powerful, and a Maintenance Contract Flattening replaces an include with the ip4/ip6 ranges it resolves to, lookups drop to zero. The catch: providers rotate ranges without telling you, and a stale flattened record silently un-authorizes their new IPs, failing SPF for real mail. So flatten only stable, slow-moving providers, or use tooling that re-resolves and updates automatically, and never hand-flatten Google or Microsoft, whose ranges shift. Flatten last, after fixes 1 and 2, for the stubborn remainder. **After any change, verify the whole chain:** re-run the [SPF Checker](https://warminboxes.com/spf-checker) (new count + tree), then send a real test and read the receiver's verdict in the [Header Analyzer](https://warminboxes.com/header-analyzer), `spf=pass` with your domain in the envelope is the finish line. And remember only ONE SPF record may exist per domain: merging fixes into a second TXT record is itself a permerror. ## Frequently Asked Questions ### What is the SPF 10 lookup limit? RFC 7208 caps SPF evaluation at 10 DNS-querying mechanisms per check: every include, a, mx, ptr, exists, and redirect costs one, and includes count recursively, so include:_spf.google.com costs 1 for itself plus 3 more for the includes nested inside it. Exceed 10 and receivers return permerror: your SPF effectively fails despite the record looking valid. ### What does SPF permerror do to my cold email? Permerror means receivers couldn't evaluate your SPF, most treat it as SPF failing, and under DMARC your SPF identity contributes nothing, leaving DKIM alone to carry alignment. Practically: worse placement everywhere, and if DKIM also has issues, DMARC failures. It's the most common 'everything looks configured but we're in spam' cause we find in audits. ### How do I count my SPF record's DNS lookups? You can't count just the visible mechanisms, you have to resolve every include and count what's nested inside, recursively. ip4/ip6/all cost zero; include/a/mx/ptr/exists/redirect cost one each at every level. Our free SPF Checker does the full recursive walk and shows a numbered lookup tree with a meter against the limit, that's the audit, done. ### How do I fix SPF when I'm over 10 lookups? In order of preference: (1) delete includes for services you no longer send from, audits routinely find 2-3 dead ones; (2) move non-cold-email services (marketing, support tools) onto subdomain SPF records, since each subdomain gets its own 10-lookup budget; (3) flatten selectively, replace a stable provider's include with its ip4 ranges, but only with automation or for providers whose ranges rarely change, because manual flattening breaks silently when providers rotate IPs. ### Do ip4 and ip6 mechanisms count toward the limit? No, ip4:, ip6:, and all cost zero lookups because they need no DNS resolution. That's exactly why flattening works: swapping include:provider.com (1+ lookups) for the equivalent ip4: ranges (0 lookups) buys back budget. The trade-off is maintenance: those ranges are now your responsibility to keep current. ## Get FREE .com Domains Prewarmed Inboxes So You Can Send Cold Emails Today [Get Prewarmed & Fresh Inboxes](https://app.warminboxes.com) ## Related Articles [Technical ### The Role of SPF, DKIM, and DMARC 2 min read](https://warminboxes.com/blog/spf-dkim-dmarc-guide)[Technical ### DMARC: None vs Quarantine vs Reject 5 min read](https://warminboxes.com/blog/dmarc-none-quarantine-reject-cold-email)[Technical ### How to Read Outlook's SCL Score 5 min read](https://warminboxes.com/blog/outlook-scl-score-cold-email) ## Prewarmed & Fresh Inboxes Google, Microsoft 365 and Azure inboxes with free prewarmed domains and DNS configured before you log in. Prewarmed inboxes send the day they land; every order is delivered within 48 to 72 hours. [Get Prewarmed & Fresh Inboxes](https://app.warminboxes.com) More from WarmInboxes [Google Workspace Inboxes](https://warminboxes.com/google-workspace-inboxes)[Microsoft 365 Inboxes](https://warminboxes.com/microsoft-365-inboxes)[Azure Inboxes](https://warminboxes.com/azure-inboxes)[Deliverability](https://warminboxes.com/deliverability)[Terms of Service](https://warminboxes.com/terms)[Privacy Policy](https://warminboxes.com/privacy)[Developers](https://warminboxes.com/developers)[For AI Agents](https://warminboxes.com/for-ai)[Inboxes for Instantly](https://warminboxes.com/instantly-inboxes)[Inboxes for PlusVibe](https://warminboxes.com/plusvibe-inboxes)[Inboxes for Smartlead](https://warminboxes.com/smartlead-inboxes)[Inboxes for EmailBison](https://warminboxes.com/emailbison-inboxes)[Inboxes for Apollo](https://warminboxes.com/apollo-inboxes)[Inboxes for ManyReach](https://warminboxes.com/manyreach-inboxes)[Inboxes for Claude](https://warminboxes.com/claude-inboxes)[Inboxes for ChatGPT](https://warminboxes.com/chatgpt-inboxes)[Inboxes for Grok](https://warminboxes.com/grok-inboxes)[About](https://warminboxes.com/about)[Huzayfa Majeed](https://warminboxes.com/authors/huzayfa-majeed)[How it works](https://warminboxes.com/how-it-works)[Deliverability Hub](https://warminboxes.com/deliverability-hub)[Studies](https://warminboxes.com/research)[Placement Test Log](https://warminboxes.com/research/inbox-placement-log)[Top-Level Domains](https://warminboxes.com/research/google-sender-reputation)[SURBL Study](https://warminboxes.com/research/surbl-blocklist-study)[Playbooks](https://warminboxes.com/playbooks)[Calculator](https://warminboxes.com/calculator)[Consultation](https://warminboxes.com/consultation)[Affiliate Program](https://warminboxes.com/affiliate)[Tool demos](https://warminboxes.com/videos)[Testimonials](https://warminboxes.com/testimonials)[Reddit Reviews](https://warminboxes.com/reddit)[Prewarmed on Reddit](https://warminboxes.com/prewarmed/reddit)[Inboxes on Reddit](https://warminboxes.com/inboxes/reddit)[Revenue Boost](https://warminboxes.com/revenueboost)[MailFirst](https://warminboxes.com/mailfirst)[Agency Advanta](https://warminboxes.com/agencyadvanta)[Liquid Syntax Guide](https://warminboxes.com/playbooks/liquid-syntax-guide)[The SPAM Plague](https://warminboxes.com/playbooks/spam-plague-segmentation-playbook)[Inboxing Playbook](https://warminboxes.com/inboxing-playbook)[Data Ops Hub](https://warminboxes.com/hub/data-ops)[Agency Hub](https://warminboxes.com/hub/cold-email-agency) Contact [WhatsApp +1 904 736 2539](https://api.whatsapp.com/send/?phone=19047362539&text=Hey%2C%20I%20need%20WarmInboxes&type=phone_number&app_absent=0) · [support@warminboxes.com](mailto:support@warminboxes.com) · Pembroke Pines, FL 33024, USA