2

while testing my DKIM/SPF config by using the port25.com email service, I am getting the following reply for my SPF record:

permerror (DNS void lookup limit exceeded)

However, my spf record does not have any "include":

v=spf1 mx a ip4:IP1 ip4:IP2 ip6:IP3 ~all

any idea what is going on?

When I am using https://dkimvalidator.com/results, I get a pass on the SPF.

I have checked the docs at https://mxtoolbox.com/problem/spf/spf-void-lookups and found this here:

"The void lookup limit was introduced in RFC 7208 and refers to DNS lookups which either return an empty response (NOERROR with no answers) or an NXDOMAIN response."

It's not doing ant DNS lookups, or is it?

uncovery
  • 305
  • 5
  • 14

1 Answers1

5

The a and mx mechanisms do a DNS lookup each, and mx then does an additional or even several more lookups to fetch the MX addresses. So it is possible that this record would exceed the global lookup limit (though it would certainly be surprising to have so many mail exchanges configured in DNS!).

The error is about the void lookup limit, however, which is 2, and that is trivially exceeded, simply if no results are returned for (1) the a lookup, (2) the mx lookup, and (3) the mail exchange address lookup.

This would of course be easier to debug if you could provide the domain in question.

glts
  • 897
  • 5
  • 17
  • Here is the relevant section in the RFC: https://www.rfc-editor.org/rfc/rfc7208#section-4.6.4. (Rereading it, it sounds like the void lookup limit should actually only apply to *terms*, which would be 2 in this case.) – glts Jun 03 '20 at 08:39
  • It's easy to get to three: two MX records with hostnames that don't exist, and one address record that doesn't exist (it's unfortunately still quite common for names to not have an AAAA record, and that gives you one NOERROR for each name). – Michael Hampton Jun 03 '20 at 15:51