SPF Lookup Limits: Solving the 10-Lookup Problem

The 10-Lookup Limit

SPF records allow a maximum of 10 DNS lookups. Exceed this limit and your SPF record silently fails—causing email authentication problems without any obvious error.

This limit exists because SPF checks happen during email delivery, and too many DNS queries would slow down email servers handling millions of messages.

Why Shopify Merchants Hit This Limit

Modern e-commerce requires multiple email services:

Service	SPF Include	Lookups Added
Shopify	include:shops.shopify.com	1+
Klaviyo	include:sendgrid.net	2+
Google Workspace	include:_spf.google.com	3+
Mailchimp	include:servers.mcsv.net	1+
Zendesk	include:mail.zendesk.com	2+
Freshdesk	include:email.freshdesk.com	1+

Each include: statement counts as one lookup, but the included records might contain their own include: statements—creating nested lookups that quickly add up.

How to Count Your Lookups

Not all SPF mechanisms count toward the limit:

Counts as a Lookup

• include: — Includes another SPF record
• a — Looks up A records
• mx — Looks up MX records
• ptr — Looks up PTR records (deprecated)
• exists: — Checks if record exists
• redirect= — Redirects to another SPF record

Does NOT Count

• ip4: — Direct IP addresses
• ip6: — Direct IPv6 addresses
• all — Final mechanism

Checking Your Lookup Count

Manual Method

1. Look up your SPF record
2. Count each include:, a, mx, ptr, exists:, and redirect=
3. For each include:, look up that record and count its mechanisms
4. Continue recursively until all lookups are counted

Example Calculation

Your SPF record:

v=spf1 include:shops.shopify.com include:sendgrid.net include:_spf.google.com -all

Counting:

• include:shops.shopify.com = 1 + (nested includes in Shopify’s record)
• include:sendgrid.net = 1 + (nested includes in SendGrid’s record)
• include:_spf.google.com = 1 + (Google has 2-3 nested includes)

Total: Often 8-12 lookups from just these three services.

Automated Check

Use Recon’s SPF analyzer or tools like MxToolbox SPF Record Lookup to see your total lookup count and a breakdown of each include’s contribution.

Consequences of Exceeding the Limit

Lookup Count	Result
1-10	SPF works normally
11+	SPF returns “permerror” (permanent error)

When SPF returns permerror:

• Email servers may treat all your emails as failing SPF
• DMARC alignment fails (if relying on SPF)
• Deliverability drops significantly
• Some servers reject emails outright

The dangerous part: There’s no warning. Your emails may fail silently for weeks before you notice.

Solutions for Shopify Merchants

Option 1: Remove Unused Services

Audit which services actually send email:

1. List all services in your SPF record
2. For each one, ask: “Do we still use this for email?”
3. Remove includes for services you no longer use

Common culprits:

• Old email marketing platforms you’ve switched from
• Trial software you never removed
• Acquired domains with inherited SPF records

Option 2: Use IP Addresses Directly

Replace include: statements with ip4: where possible:

Before:

v=spf1 include:mail.thirdparty.com -all

After:

v=spf1 ip4:192.0.2.1 ip4:192.0.2.2 -all

Caution: IP addresses can change. Only use this for services with stable, documented IP ranges.

Option 3: SPF Flattening

SPF flattening resolves all includes to IP addresses automatically:

Before (12 lookups):

v=spf1 include:shops.shopify.com include:sendgrid.net include:_spf.google.com -all

After flattening (0 lookups):

v=spf1 ip4:23.227.38.0/24 ip4:167.89.0.0/17 ip4:209.85.128.0/17 ... -all

Important: Flattened records must be updated when providers change IPs. Use a service or automation to maintain them.

Option 4: SPF Flattening Services

Dedicated services manage flattened SPF records:

• They resolve includes to IPs automatically
• They update records when provider IPs change
• You point your SPF to their service

This is the most reliable solution for complex setups.

Option 5: Prioritize DKIM

If reducing lookups is difficult, ensure DKIM is properly configured:

• DMARC can pass with either SPF OR DKIM alignment
• Strong DKIM setup provides authentication even if SPF has issues
• Some merchants deprioritize SPF in favor of DKIM

This isn’t ideal but can be a pragmatic solution.

Common SPF Mistakes

Nesting Too Deep

Bad: Multiple services that each have multiple nested includes

include:servicea.com (contains 3 more includes)
include:serviceb.com (contains 4 more includes)
include:servicec.com (contains 3 more includes)

Multiple SPF Records

You can only have ONE SPF record. Multiple records cause failures:

Wrong:

v=spf1 include:shops.shopify.com -all
v=spf1 include:sendgrid.net -all

Right:

v=spf1 include:shops.shopify.com include:sendgrid.net -all

Forgetting the Limit Exists

Most merchants don’t know about the 10-lookup limit until emails start failing.

What Recon Detects

Issue	Severity	Description
SPF exceeds 10 lookups	High	X lookups exceeds the 10-lookup limit
SPF at limit (10 lookups)	Medium	Adding any service will break SPF
Multiple SPF records	Critical	Causes immediate SPF failures
Deprecated mechanisms	Low	Using ptr or other outdated mechanisms

How Recon Helps

Recon monitors your SPF configuration by:

• Counting total DNS lookups including nested includes
• Alerting you before you hit the limit
• Identifying which services consume the most lookups
• Providing specific guidance for consolidation
• Tracking changes over time

Recommended SPF Record for Shopify

For most Shopify stores using common services:

v=spf1 include:shops.shopify.com include:sendgrid.net include:_spf.google.com -all

This covers:

• Shopify transactional emails
• Klaviyo (uses SendGrid)
• Google Workspace

Lookup count: Typically 7-9, leaving room for one or two additional services.

FAQ

Q: My SPF has 11 lookups but emails still work. Why?

A: Some email servers are lenient and process SPF even with excess lookups. However, strict servers will fail your emails. Don’t rely on leniency.

Q: Can I just remove the -all to reduce problems?

A: No. The -all or ~all suffix doesn’t count as a lookup. Removing it actually weakens your SPF protection.

Q: How often do provider IPs change?

A: Major providers like Google and SendGrid rarely change IP ranges, but it does happen. If using flattened records, monitor for changes or use an automation service.

Q: Does splitting SPF across subdomains help?

A: Yes, if different subdomains use different email services. Each subdomain has its own 10-lookup limit. For example, marketing.yourstore.com could have a separate SPF for marketing platforms.

Q: What’s the priority: fixing lookups or adding DKIM?

A: Both. But if you must choose, ensure DKIM is working first. DMARC can pass with just DKIM, providing authentication even while you fix SPF issues.