SPF exceeds the 10-DNS-lookup limit

Check id: spf.lookups_over_10 · fix effort: medium

What it means

Your SPF record is too complex for mail servers to process. Past a hard limit of 10 lookups they give up, and legitimate mail can start failing authentication.

The technical detail

Resolved include/a/mx/ptr/exists/redirect terms exceed the RFC 7208 limit of 10 DNS lookups. Result is permerror at the receiver.

How to fix it

1. Remove includes for services you no longer use.
2. Flatten nested includes into ip4/ip6 mechanisms, or use a managed SPF flattening service.
3. Send different mail streams from subdomains with their own SPF records.
4. Rescan. the counter shows the resolved total.