SPF: Include policy resulting in recursion

What this means

Your SPF record contains an ‘include:’ statement which results in recursion.

Why this is a problem

This will cause the SPF record to exceed the maximum allowable DNS lookups of 10, which will cause the SPF record to become void. This will then affect email deliverability and security.

How to check if the problem is there

Perform an iterative TXT lookup for every include record contained in your SPF record.

Verify that each lookup does not have an include which results in a circular lookup.

You might want to use the following online tools to check for this issue:

• National Cyber Security Centre’s (NCSC) check your email security tool
• Hardenize’s domain report tool

How to fix this

Identify whether this include record is still required.

If it is no longer required, remove it from your SPF record.

If it points to a third party service, contact the third party to inform them of the issue and retrieve the new location of the include to update in your SPF record accordingly.

If this points to an internal record then amend the structure of your SPF includes so that no circular lookups are created.