Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are migrating from a self hosted mailing platform to Office365 for Businesses. Everything went fine, except for the SPF record. At the moment, we have v=spf1 a mx -all as TXT record, but Office365 has to allow v=spf1 -all too. So, I went ahead and and merged them into: v=spf1 a mx -all. When checking this SPF record against the domain of, this results into a PermError SPF Permanent Error: Too many DNS lookups.

My question is the following: How do I work around this error? I know I can replace some records with their ip4 equivalent, but when doing this, the online troubleshooter of Office365 kept complaining that the record was not found: enter image description here

Thanks in advance!

share|improve this question
Do other SPF-checking-tools complain? Does Office 365 work with these records? (or are you not even able to set it up?) - As I understand, those records are only temporary, until your migration is done. So I would leave them as is (if it works), and just correct them once you're finished migrating – MichelZ Apr 19 '14 at 8:59
Office365 and pySPF complain. As we use our Office365 for the whole business, it is a priority that Office365 accepts the record. We use an external DNS (not the one from Office365) so we are able to set it up, it just doesn't get accepted. This is not a temporary record; we have already migrated (so everything is up and running) but that record requires Office365 exchange to work correctly. – Silox Apr 19 '14 at 9:04
So why do you need the record at all? That's not required for O365? Or do you send out e-mails using another server than O365? – MichelZ Apr 19 '14 at 9:06
I hear you, but the answers to the former are all the answers you need to this one (except inasmuch as they don't specify what your SPF record should be, and we don't do that here). I nearly quoted my previous answer back at you, which I'm told is a strong suggestion that the question is really a duplicate (I'd quote the reference post, but I cannot currently find it). Don't worry too much, it's only my opinion, and others may not agree with me - if they don't, it won't get closed. – MadHatter Apr 19 '14 at 10:36
That said, I will add that the short form answer to the question of how to make your record match the spec is you can't - or, slightly more wordily, there is no simple way to combine multiple DNS-expensive SPF records into a single SPF record without violating the DNS-lookup restrictions of the spec. The complex ways are covered in the answers to the question that I suggest is a duplicate. – MadHatter Apr 19 '14 at 10:40
up vote 4 down vote accepted

Apart from everything that has already been said, let's focus on this:

My question is the following: How do I work around this error? I know I can replace some  
records with their ip4 equivalent, but when doing this, the online troubleshooter of  
Office365 kept complaining that the record was not found:

I recently ran into the same problem.
While it is documented that it should work ( we could never get it to verify with a different record.
It didn't matter if it was or ip4:, it always complained about the SPF record being wrong/missing.
In the end we changed the record to v=spf1 -all to make the verification wizard happy and adjusted it back afterwards to the real record.

share|improve this answer
I've seen some SPF checkers required their domain to be listed first and then it will pass with both domains included. – citadelgrad Sep 8 '14 at 20:37

Answer taken from SO here Author: Swift. Adapted to fit the question. Also, have a read here on general SPF stuff.

We started with:

v=spf1 a mx ~all

We get 10 total lookups before we throw the Too many DNS lookups error:

  2 (Initial TXT & SPF Lookups)
  2 (a & mx Lookups)
  1 (
  1 (
 +1 (
  7 Lookups

So without even following the included SPF records, we have 7 lookups.

Now, let's dive a level deeper.


The google SPF record evaluates to:

v=spf1 ?all

Each of which resolve to the following values:

v=spf1 ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ?all

v=spf1 ip6:2607:f8b0:4000::/36 ip6:2a00:1450:4000::/36 ?all

So google gives us 2 more lookups, bringing the total up to 9 Lookups.


Mailchimp is a bit of a doosey because it adds a whole 3 extra lookups:

v=spf1 ?all

I would imagine that depending on what you're sending through Mailchimp, you might be able to remove one or two of these records (but you'll have to evaluated that yourself).

Anyway, those resolve to the following:

v=spf1 ip4: ip4: ip4: ip4: ip4: ip4: ip4: ?all

v=spf1 ip4: ip4: ip4: ip4: ip4: ip4: ip4: ?all

v=spf1 ip4: ip4: ?all

This brings us up to a total of 12 Lookups (Which is two over the limit already).


SendGrid ends up being the fewest number of additional lookups for us.

v=spf1 ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ~all

So the only additional lookup here is, which evaluates to:

v=spf1 ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ~all

This brings our grand total up to 14 lookups.

So our grand total is 14 Lookups. We need to get that down to 10. I've outlined a couple of options below, you may need to use more than 1 of them to get it down.

  1. Directly include some of the redirected spf records. Now that we know which servers the spf records redirect to, you could cut out the middleman and include them directly. Note: If any of the services end up changing their SPF records, you'll have to go through the process of updating yours manually.

  2. Remove some of the services that you're using. Not sure what your use case is for having all of these services, but there's definitely some overlap that you might be able to use. For instance, SendGrid supports (1) transactional outgoing mail, (2) newsletter / marketing emails, and (3) incoming mail. So there may be some reducible redundancy.

  3. Remove the MX record if it is redundant. Depending on your setup, the MX lookup can be redundant.

share|improve this answer
Thank you for your answer. I did already see that answer in the post you linked to, but that offered no solution. If you check the SPF from Office365, this results in a cluster of a LOT of IPs: dig TXT returns 11 IPs while dig TXT results in a continuous redirection from one lookup to another... – Silox Apr 19 '14 at 9:28
The mx directive can easily lead to more than one additional lookup. If there are N MX records where the A/AAAA records are not included in the initial response (eg, out of zone, which is rather common) there will be N additional lookups. I would question the validity of a and mx, are those really sending mail? Having GApps included in SPF suggests that your MX records may point there? In that case the mx bit is just wrong and costs 7 additional lookups if you have their full set of inbound servers specified. – Håkan Lindqvist Apr 19 '14 at 12:12
(Ie, the grand total may not be 14 but 21 if that is the case.) – Håkan Lindqvist Apr 19 '14 at 12:20
The values in this post are just "examples" from another post. It just demonstrates "how" to do the counting, it is not a direct answer to the question with a step-by-step guide – MichelZ Apr 19 '14 at 12:25
Alright, I didn't pay enough attention, thought it had been adapted to the OPs record. Either way, the general idea regarding mx applies regardless. – Håkan Lindqvist Apr 19 '14 at 12:32

I can see this this is a great reason to create subdomains specifically for sending out through 3rd-parties:

If you have different 3rd party senders handling different things that can be signed up for, then setting up a separate subdomain can be a great way to manage it:

The subdomain names could be based on what is being sent:

  • for newsletter sent out through a third party could have spf record specific to that 3rd party.
  • for when "updates" have been signed up for.
  • for when "Support" is provided through 3rd party.

Or the subdomain names could be based upon the 3rd party sender it is for:

  • for Constant Contact emails
  • for Mail Chimp emails
  • for ZendDesk emails

I actually like this idea now that I've mapped it out! I will try this out myself. It will mean setting up additional email addresses for those subdomains, but that will allow easier organization of emails.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.