Sender Policy Framework (SPF) is simple on paper: publish a TXT record listing who may send mail for your domain. In practice, SaaS tools stack include: mechanisms until you hit the DNS lookup ceiling—and mail starts failing authentication checks without a clear bounce to your team.
The 10-DNS-lookup rule
RFC 7208 limits SPF evaluation to 10 DNS lookups during resolution. Mechanisms that trigger lookups include,a,mx, ptr, and exists. The all mechanism does not count.
Nested includes count recursively. A marketing platform, ticketing vendor, and three regional ESPs can exhaust the budget quickly—especially after acquisitions add another subdomain policy.
What PermError means for deliverability
When evaluation fails due to too many lookups, SPF returns PermError. Receivers treat the SPF check as broken; alignment with DMARC may fail even if DKIM still passes. Some messages deliver; others soft-fail or land in spam depending on mailbox policy.
Flattening and why it is a trade-off
Flattening replaces nested includes with direct IP ranges to save lookups. It works until vendors rotate IPs without notice, leaving you with stale entries and false negatives.
- Pros: fewer lookups, faster evaluation
- Cons: manual maintenance, vendor IP drift, audit complexity
Prefer consolidating vendors, subdomains per sender (mail.vendor.example.com), or dedicated SPF trees over permanent flattening when possible.
Check before you ship
Use the Rootwise SPF checker to count lookups, validate syntax, and spot PermError risk on any domain—without digging through nested TXT chains manually.
Validate SPF on every change
Treat SPF like code review: run checks when you add a SaaS sender, migrate ESPs, or inherit domains from M&A. Pair SPF with DMARC reporting so failures show up in aggregate data, not only in black-box deliverability scores.
v=spf1 include:_spf.google.com include:sendgrid.net -all
# Each include consumes lookups from nested records
Rootwise monitors TXT records alongside DKIM and DMARC so drift surfaces in the same dashboard as DNS and SSL issues—one severity model for the whole domain stack.