SPF Void Lookups: The Hidden Limit That Breaks Email Authentication

Most people who manage SPF records know about the 10 DNS lookup limit. But there is a second, lesser-known limit that can break your email authentication just as badly: the void lookup limit. If you have ever seen an SPF PermError and could not figure out why — your lookup count was under 10 and your syntax looked fine — void lookups might be the culprit.

This guide explains what void lookups are, why they cause problems, and how to find and fix them. For a broader overview of SPF, see our complete SPF guide.

What Is a Void Lookup?

A void lookup is a DNS query triggered during SPF evaluation that comes back empty. Specifically, it is a query that returns either:

• NXDOMAIN — the domain does not exist at all
• Empty answer — the domain exists but has no records of the requested type

When a receiving mail server evaluates your SPF record, it follows every include, a, mx, and redirect mechanism by making DNS queries. If any of those queries return nothing, that counts as a void lookup.

The 2 Void Lookup Limit

The SPF specification (RFC 7208, Section 11.1) limits SPF evaluation to 2 void lookups. If a third void lookup occurs during evaluation, the check immediately returns a PermError.

This is a completely separate limit from the 10 DNS lookup limit. You can be well under 10 total lookups and still hit a PermError because of void lookups. Here is how the two limits compare:

Both limits exist to protect the email infrastructure (RFC 7208 Section 4.6.4). The 10 lookup limit prevents excessive DNS traffic. The void lookup limit prevents SPF records from sending queries to domains that do not exist, which could be used for DNS-based attacks or simply waste resources.

What Causes Void Lookups?

Void lookups almost always come from one of these situations.

Typos in include domains

A small misspelling in an include domain is the most common cause. For example:

v=spf1 include:_spf.gogle.com include:sendgrid.net ~all

The typo _spf.gogle.com (missing an "o") causes a void lookup because that domain does not exist. The correct domain is _spf.google.com.

Deleted or expired DNS records

If you included a domain that had valid DNS records when you set it up but those records have since been removed, every SPF check now produces a void lookup. This can happen when:

• A vendor changes their SPF include domain without notifying you
• A DNS record was accidentally deleted during a migration
• A subdomain you referenced was decommissioned

Decommissioned email services

When you cancel an email service but forget to remove its include from your SPF record, the include domain may eventually stop resolving. What was once a valid include becomes a void lookup. A regular SPF record audit can catch these before they cause problems.

Using the a mechanism with non-existent subdomains

If your SPF record contains a:mail.yourdomain.com and that subdomain has no A record, it produces a void lookup.

How to Find Void Lookups

The easiest way to find void lookups is to check your SPF record with a tool that specifically tests for them.

The checker evaluates your entire SPF record, follows all includes, and flags any DNS queries that returned empty results. You can also identify void lookups manually:

How to Fix Void Lookups

Once you have identified which mechanisms are causing void lookups, the fix is straightforward.

Remove includes for services you no longer use. If you cancelled Mailchimp six months ago, remove include:servers.mcsv.net from your SPF record.

Correct typos. Double-check the spelling of every include domain against the email provider's official documentation. Even one wrong character creates a void lookup.

Update outdated include domains. Some providers change their SPF include domains over time. Check your provider's current setup instructions and update your record accordingly. If you are unsure what your SPF record should look like, SPF Creator can build the correct record based on your active services.

Remove references to non-existent subdomains. If you use a: or mx: mechanisms that point to subdomains, make sure those subdomains have the expected DNS records.

Void Lookups vs. the 10 DNS Lookup Limit

It is worth understanding how these two limits interact, because fixing one can sometimes reveal the other.

Void lookups count toward your total DNS lookup count. If your SPF record triggers 8 valid lookups and 3 void lookups, you are over both limits — but the void lookup limit (exceeded at 3) would trigger the PermError before the 10 lookup limit does.

After removing void lookups, re-check your total lookup count. Removing broken includes reduces both your void lookup count and your total lookup count, which is a win on both fronts.

Preventing Void Lookups

The best approach is to prevent void lookups from happening in the first place.

Verify before publishing. Before adding any new include to your SPF record, confirm the domain exists and has a valid SPF record. Use the checker tool to validate the complete record before saving it to DNS.

Clean up after cancelling services. When you stop using an email service, remove its include from your SPF record immediately. Do not leave it for later — you will forget, and eventually the domain may stop resolving.

Document your SPF record. Keep a simple list of what each include is for. This makes it easy to identify which ones to remove when things change.

Monitor continuously. A void lookup can appear without you making any changes — all it takes is a provider changing their DNS setup. The Email Deliverability Suite monitors your SPF, DKIM, and DMARC records daily and alerts you when something breaks, including void lookup issues.

References

• RFC 7208: Sender Policy Framework (SPF) — The current SPF specification
• RFC 7208 Section 11.1: Processing Limits — The 2 void lookup limit
• RFC 7208 Section 4.6.4: DNS Lookup Limits — The 10 DNS lookup limit