How to set up SPF without breaking the 10-lookup limit

An SPF record lists who may send mail for your domain. It has one limit that catches many people: evaluating it can't take more than 10 DNS lookups. Go over, and SPF returns a permanent error even though every sender is listed.

What counts as a lookup

The mechanisms include, a, mx, ptr, exists and the redirect modifier each count. An include also counts everything inside the record it points to. ip4, ip6 and all don't count.

Only one record

A domain must have a single SPF record. If you have two TXT records starting with v=spf1, merge them.

v=spf1 include:_spf.example-mail.com include:_spf.example-crm.com ~all

How to get back under 10

1. Remove tools you no longer use. Old includes are the most common cause.
2. Remove ptr, which the specification says not to use.
3. Move a sending tool to a subdomain with its own SPF record.

Check your work

dig +short TXT example.com

Then send a real message and confirm SPF shows as passing in the message details.