SPF Lookup Limit Exceeded
Evidence-first troubleshooting runbook for spf lookup limit exceeded.
Production note: DNS and authentication changes should be staged, validated with independent resolvers, and rolled out with a documented rollback path.
Symptom
Record the exact Authentication-Results line, DNS response, timestamp, source IP, envelope sender, visible From domain, and DKIM selector before changing anything.
Immediate triage
- Stop related DNS changes.
- Compare authoritative and recursive answers.
- Inspect one raw delivered or rejected message.
- Identify whether the failure is DNS, signing, identity, or caching.
Evidence commands
dig +trace example.com
dig @1.1.1.1 TXT _dmarc.example.com
dig @8.8.8.8 TXT selector1._domainkey.example.com
opendkim-testkey -d example.com -s selector1 -vvvRecovery sequence
Correct one layer, wait for the applicable TTL, send controlled tests, and verify the final provider result before restoring normal traffic.
Prevention
- Version-control DNS records.
- Monitor selectors and policy records.
- Use staged TTL changes.
- Maintain a sender inventory.
- Run pre-deployment authentication tests.