How to Clean Up SPF Includes and Stay Under the 10-Lookup Limit

SPF tells receivers which servers are allowed to send mail for your domain. The common failure is a long chain of old includes that pushes the record over the SPF DNS lookup limit.

Before you change anything

• Do not flatten SPF unless you have a maintenance plan. Provider IP ranges change.
• Do not publish more than one SPF TXT record at the same hostname.
• Confirm the sender inventory before deleting any include.

Step-by-step repair process

1. Find the current SPF record. Look for one TXT record beginning with v=spf1 at the domain or subdomain being used to send.
2. Count DNS lookup mechanisms. Include, a, mx, ptr, exists, and redirect mechanisms can count toward SPF evaluation work.
3. Remove duplicate vendor includes. Many domains carry old marketing tools, retired outbound tools, or duplicate includes from earlier migrations.
4. Replace broad includes with the vendor’s current recommendation. Use the active provider documentation instead of copying a random SPF string from another domain.
5. Retest after each change. Check syntax, lookup count, and whether each active sender still passes SPF or DKIM alignment.
6. Pair SPF cleanup with DKIM and DMARC review. SPF alone is not enough for a modern sender-trust setup.

Common mistakes to avoid

• Publishing two SPF records instead of merging them into one.
• Adding “include” records for tools that only need DKIM.
• Using SPF flattening as a permanent shortcut without monitoring provider IP changes.

Related repair guides

Reference points

These are technical reference points, not a substitute for checking your real message headers and sender inventory.

• SPF standard
• Google Workspace SPF guidance