PayFlowFix.dev
guide · spf too many dns lookups

SPF too many DNS lookups

Your SPF record exceeded the RFC 7208 limit of 10 DNS lookups, so receivers return permerror and behave as if you had no SPF at all. Here is how to count your lookups and get back under the limit without breaking delivery.

What this actually means

This is the common pattern we see when spf too many dns lookups comes up in search.

Run the free checker on your domain to see your own numbers. The checker shows the full SPF include chain, the exact lookup count, and which selector actually exists for DKIM.

Why it matters for payment flows

Customers who pay successfully but never get a receipt, invoice or status update assume the payment failed. Support tickets follow, refunds are requested, and the engineering team spends hours debugging a webhook that never had a chance to be read.

What to do next

  1. Check the domain with the free tool.
  2. Fix the mechanical issue first — lookup limit, missing DKIM, absent DMARC. Those are checkable in under a minute.
  3. If email authentication is clean and the customer still sees nothing, the fault is downstream: a webhook that failed signature verification, an event type you never subscribed to, or a status that never synced.

Sources and standards

  • RFC 7208 SPF, RFC 7489 DMARC, RFC 6376 DKIM — the actual specifications, not a blog summary.
  • Lookup counts measured live with the engine in this repo, https://payflowfix.dev.

FAQ

SPF "too many DNS lookups": what it means and how to fix it
Your SPF record exceeded the RFC 7208 limit of 10 DNS lookups, so receivers return permerror and behave as if you had no SPF at all. Here is how to count your lookups and get back under the limit without breaking delivery.
Where does this fit in a payment flow?
Email authentication is upstream of whether a customer ever sees a receipt. If SPF, DKIM or DMARC is broken, the receipt, invoice or password reset lands in spam or is rejected. That looks like a payment integration failure, but it is DNS.
Can I check this myself?
Yes — the free checker expands your whole SPF chain and counts lookups the way a receiver does. Paste your domain and you get a copy-ready record.
Do you log my domain?
No. The checker runs in your browser against Cloudflare and Google DNS-over-HTTPS. This site is static; there is no backend.

Still broken after the DNS is right?

Email authentication is DNS. Payment notifications not arriving is usually not — it is a webhook that failed signature verification, an event type you never subscribed to, or a status that never synced. That is what I fix: a fixed-fee $99 root-cause diagnosis, credited toward the repair.

Get a $99 diagnosis What I fix