SPF Void Lookups: The Hidden Limit You Don't Know About

The Void Lookup Limit

Most people know about SPF's 10 DNS lookup limit. Fewer know about the 2 void lookup limit—and it can cause permerror just as easily.

Void lookup: A DNS query that returns NXDOMAIN (domain doesn't exist) or an empty result.

RFC 7208 Section 4.6.4 states:

If [...] the number of "void lookups" [...] exceeds 2, processing [...] terminates and the result is "permerror."

Two failed DNS queries = SPF failure.

How Void Lookups Happen

Cause 1: Defunct ESP Includes

You added an ESP years ago, they went out of business or changed their SPF domain, but you never removed the include.

# Old ESP shut down, domain no longer exists
include:_spf.oldesp.com

dig TXT _spf.oldesp.com +short
# Returns nothing → void lookup

Cause 2: Typos

Simple spelling mistakes create void lookups:

# Typo: sendgird instead of sendgrid
include:sendgird.net

# Typo: missing underscore
include:spf.google.com  # Should be _spf.google.com

Cause 3: Acquisition Changes

Company A gets acquired by Company B, and their SPF domain changes:

# Before acquisition
include:_spf.acquired-company.com

# After acquisition — old domain goes away
# New domain is _spf.newparent.com

Cause 4: No SPF Record at Target

The domain exists but has no SPF record:

dig TXT _spf.partner.com +short
# Domain exists but returns no TXT record → void lookup

Practitioner note: The most common void lookup I encounter is from ESPs that got acquired. Sendinblue became Brevo, but old SPF records still reference sendinblue.com. The domain still exists, but the SPF structure changed.

Detecting Void Lookups

Using MXToolbox

1. Go to MXToolbox SPF Record Lookup
2. Enter your domain
3. Look for warnings about void lookups or NXDOMAIN responses
4. Check each include in the chain

Using dig Manually

Check each include in your SPF record:

# Your SPF record
dig TXT yourdomain.com +short | grep spf

# Check each include
dig TXT _spf.google.com +short      # Should return data
dig TXT sendgrid.net +short         # Should return data
dig TXT oldesp.com +short           # If empty → void lookup

If a query returns nothing or NXDOMAIN, that's a void lookup.

Using dmarcian

dmarcian's SPF surveyor visualizes the entire include chain and flags void lookups with clear warnings.

Fixing Void Lookups

Step 1: Identify the Problem Includes

Test each include in your record. Note which ones return empty results.

Step 2: Remove or Update

For defunct ESPs: Remove the include entirely if you no longer use the service.

For typos: Fix the spelling.

For acquisitions: Check the ESP's current documentation for their updated SPF include.

For missing SPF at target: Contact the service or use a different authorization method (like ip4 if they provide static IPs).

Step 3: Verify the Fix

# Check your updated record
dig TXT yourdomain.com +short

# Verify with MXToolbox
# Confirm void lookup count is 0-2

Example: Before and After

Before (3 void lookups → permerror):

v=spf1 include:_spf.google.com include:_spf.oldesp.com include:sendgird.net include:partnernorecord.com ~all

• _spf.google.com → Works
• _spf.oldesp.com → NXDOMAIN (void #1)
• sendgird.net → NXDOMAIN, typo (void #2)
• partnernorecord.com → Empty (void #3)

Result: 3 void lookups → permerror

After (0 void lookups):

v=spf1 include:_spf.google.com include:sendgrid.net ~all

• Removed defunct ESP
• Fixed typo
• Removed partner without SPF record

Prevention

Audit Regularly

Check your SPF includes every quarter. Services change, get acquired, or shut down.

Test Before Publishing

Before adding a new include, verify it returns data:

dig TXT _spf.newesp.com +short

Document Your Senders

Maintain a list of services that send email for your domain. When you stop using one, remove its include.

Practitioner note: I add SPF audits to quarterly maintenance for all clients. The void lookup issue creeps up silently—you don't notice until someone reports deliverability problems months later.

Void Lookups vs DNS Lookup Limit

Limit	What Counts	Maximum
DNS Lookup	All include, a, mx, redirect, exists	10
Void Lookup	Only queries returning NXDOMAIN or empty	2

You can hit the void limit without hitting the DNS limit. Two bad includes = permerror, even if you only have 2 total includes.

For the related DNS lookup limit, see the SPF 10-lookup limit guide. For debugging techniques, see debugging SPF failures. For the complete SPF reference, see the SPF setup guide. If you're experiencing SPF permerrors and can't identify the cause, schedule a consultation. I'll trace your entire SPF chain and identify void lookups you might have missed.

Sources

• RFC 7208: Sender Policy Framework (SPF), Section 4.6.4 — DNS Lookup Limits
• RFC 7208: Section 11.1 — Processing Limits
• MXToolbox: SPF Record Check
• dmarcian: SPF Surveyor

---

v1.0 · March 2026