Too many SPF lookups?

user_464419 0
Viewed 754

How do I handle it if my hosting provider's default SPF record includes more IP lookups than are allowed by DMARC (maximum 10)? Here's the default SPF record for rockridgencpc.com:

v=spf1 +a +mx +ip4:35.208.189.85 include:_spf.mailspamprotection.com ~all

If you run that through the DMARC SPF checker you'll find that mailspamprotection.com has 3 MX servers but each MX server has 12 separate IP addresses. This way overruns the maximum of 10 allowed "lookups." My hosting provider says that's the default and so far won't discuss the fact that their default is in violation of an internet standard. I've gotten the error from 2 different SPF checkers. Since I set their default I haven't been able to send email through the forwarder addresses in our domain, although other people can.

spf
2 Answers

IP addresses don't count towards the total because they don't require DNS lookups. From RFC7208 section 4.6.4:

The other terms -- the "all", "ip4", and "ip6" mechanisms, and the "exp" modifier -- do not cause DNS queries at the time of SPF evaluation (the "exp" modifier only causes a lookup at a later time), and their use is not subject to this limit.

This is also why you should always put literal IP mechanisms first in your SPF as they are fastest for receivers to handle. Your entire set of targets can be resolved through 6 lookups, so I don't see any contravention here or why anything should be triggering errors from these records.

user_3333400

The mx modifier makes your SPF do another round of DNS queries and it’s not necessary. Try removing the mx and then re validating and see if you’re under the 10 lookups.

If that does not work you could flatten your spf record. There are several tools for flattening records.

You could check your domain’s spf using then https://dmarcian.com/spf-survey/ which will then show the spf flattened option if you go above the 10 lookups.

user_63357250
Related