--- title: "How To Fix “A Null DNS Lookup Was Found For Include” In SPF | DMARC Report" description: "Fix the SPF null DNS lookup error by correcting invalid include records and updating DNS settings to improve email deliverability." image: "https://dmarcreport.com/og/blog/fix-null-dns-lookup-errors-caused-by-spf-include-records.png" canonical: "https://dmarcreport.com/blog/fix-null-dns-lookup-errors-caused-by-spf-include-records/" --- Quick Answer Fix the SPF null DNS lookup error by checking invalid or outdated include records, verifying included domains have valid SPF records, removing incorrect entries, and updating your DNS settings to ensure proper email authentication and deliverability. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Ffix-null-dns-lookup-errors-caused-by-spf-include-records%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20To%20Fix%20%E2%80%9CA%20Null%20DNS%20Lookup%20Was%20Found%20For%20Include%E2%80%9D%20In%20SPF&url=undefined%2Fblog%2Ffix-null-dns-lookup-errors-caused-by-spf-include-records%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Ffix-null-dns-lookup-errors-caused-by-spf-include-records%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Ffix-null-dns-lookup-errors-caused-by-spf-include-records%2F&title=How%20To%20Fix%20%E2%80%9CA%20Null%20DNS%20Lookup%20Was%20Found%20For%20Include%E2%80%9D%20In%20SPF "Share on Reddit") [ ](mailto:?subject=How%20To%20Fix%20%E2%80%9CA%20Null%20DNS%20Lookup%20Was%20Found%20For%20Include%E2%80%9D%20In%20SPF&body=Check out this article: undefined%2Fblog%2Ffix-null-dns-lookup-errors-caused-by-spf-include-records%2F "Share via Email") ![Null DNS Lookup](https://media.mailhop.org/dmarcreport/dmarc-check-4586-1793605285472.jpg) An SPF record helps receiving [mail servers](https://www.cloudflare.com/learning/email-security/what-is-a-mail-server/) verify whether a sending server is authorized to send emails on behalf of a domain. However, an incorrectly configured SPF record can trigger DNS lookup errors and interfere with SPF evaluation. One warning you may encounter during an SPF check is “A Null DNS Lookup Was Found for Include.” This message usually indicates that an SPF include mechanism points to a hostname that does not return the **expected DNS information**. To resolve this issue, identify the problematic include, check its DNS response, and correct the SPF configuration without exceeding lookup limits. This guide explains what the warning means, its common causes, and how to fix it. ## What Does “A Null DNS Lookup Was Found to Include” Mean? An SPF include mechanism allows a domain owner to authorize another domain’s SPF policy as part of their own record. Businesses commonly use it when sending emails through third-party services, such as marketing platforms and cloud email providers. For example: ``` v=spf1 include:_spf.example.com -all ``` _The receiving server checks the SPF policy published by \_spf.example.com when evaluating the sending domain_. A void DNS lookup generally occurs when a DNS query returns NXDOMAIN or NOERROR without an answer, as **described in RFC 7208**. The warning “A Null [DNS Lookup](https://www.ibm.com/think/topics/dns-lookup) Was Found for Include” is a diagnostic message used by some SPF testing tools. It is not a formal SPF result defined by the RFC. If an included domain does not publish a valid SPF policy, its evaluation may return permerror, affecting the parent domain’s SPF evaluation. ![Dmarc Lookup 4856](https://media.mailhop.org/dmarcreport/dmarc-lookup-4856-1793605692337.jpg) ## Common Causes of a Null DNS Lookup in SPF Several DNS and configuration problems can trigger this warning. ### 1\. Incorrect Include Hostname A spelling mistake or incorrect hostname can direct a DNS query to a domain that does not exist. For example: ``` v=spf1 include:_spf.exmaple.com -all ``` If the intended hostname is different, the DNS query **may return NXDOMAIN**. Always copy the exact SPF include value from your email provider’s official documentation. ### 2\. Missing SPF Record An included hostname must publish an SPF policy for the mechanism to work correctly. If the hostname does not return a valid [SPF record](https://dmarcreport.com/blog/what-causes-spf-record-failure-and-how-to-troubleshoot-common-issues/), the include cannot be evaluated successfully. This may happen when a provider changes its [DNS configuration](https://www.digicert.com/blog/an-introduction-to-dns-configurations) or removes an older SPF hostname. ### 3\. Outdated Email Service Configuration Businesses sometimes retain [SPF includes](https://dmarcreport.com/blog/what-is-spf-include-and-safe-multiple-spf-includes-usage/) for email services they no longer use. If a provider retires or changes its sending infrastructure, an old include may stop returning the expected DNS information. Review your SPF record whenever you change **email providers or discontinue** a sending service. ### 4\. DNS Configuration Problems Missing DNS entries, incorrect records, or temporary resolution problems may prevent an included hostname from returning the expected information. _Check whether the issue occurs consistently before treating it as a permanent SPF configuration problem_. ## How to Identify the Problematic SPF Include Before editing your SPF record, identify which include is causing the warning. Removing the wrong entry could affect **legitimate email services**. ### Step 1: Find Your Current SPF Record Use a DNS lookup tool or command-line utility to retrieve your domain’s TXT records. With dig: dig TXT example.com With nslookup: nslookup -type=TXT example.com Replace example.com with your actual domain. Find the [TXT record](https://en.wikipedia.org/wiki/TXT%5Frecord) beginning with `v=spf1`. If multiple SPF records exist at the same DNS name, that is a separate configuration problem that should also be corrected. ### Step 2: List Every Include Mechanism Review your SPF record and identify all entries beginning with include:. For example: ``` v=spf1 include:_spf.google.com include:spf.example.net -all ``` This record contains **two include mechanisms**. Confirm which email services your organization currently uses before changing either entry. ### Step 3: Query Each Included Domain Check the DNS response for every included hostname. dig TXT \_spf.example.com Or: nslookup -type=TXT \_spf.example.com Look for a valid SPF policy beginning with v=spf1. If the hostname returns [NXDOMAIN](https://cleanbrowsing.org/learn/what-is-nxdomain), it does not exist in DNS. _If it returns NOERROR without an answer, the requested TXT record may be missing_. These responses require investigation before changing your SPF configuration. ### Step 4: Check the Provider’s Documentation If an included hostname does not return the **expected SPF policy**, consult your email provider’s official documentation. For example, [Google Workspace](https://jumpcloud.com/blog/what-is-google-workspace) documents this SPF include: include:\_spf.google.com Use the exact value recommended for your service. Do not guess a replacement hostname. ![Dmarc Record 4520](https://media.mailhop.org/dmarcreport/dmarc-record-4520-1793605729324.jpg) ## How to Fix a Null DNS Lookup in an SPF Include After identifying the problematic hostname, apply the correction that matches the underlying issue. ### 1\. Correct an Incorrect Include If the hostname contains a **spelling mistake or is outdated**, replace it with the exact value provided by your email service. Do not make changes based only on a similar-looking domain. Verify the correct hostname through official documentation or provider support. ### 2\. Remove an Unused Include If your organization no longer sends emails through a service, determine whether its include can safely be removed. For example, if you have confirmed that old-service.example is no longer required, you may remove it from: ``` v=spf1 include:_spf.google.com include:old-service.example -all ``` The revised record could be: ``` v=spf1 include:_spf.google.com -all ``` This is an illustrative example. Before removing an entry, check whether websites, applications, or marketing platforms still use that **service to send emails**. ### 3\. Update Outdated Provider Settings Some email providers change their DNS requirements. If a provider has replaced an older SPF hostname, follow its current setup instructions. _Update the include mechanism and verify that the new hostname returns a valid SPF policy_. Avoid creating multiple SPF TXT records while making changes. ![How To Create Dmarc Record 4586](https://media.mailhop.org/dmarcreport/how-to-create-dmarc-record-4586-1793605815494.jpg) ### 4\. Contact the Provider If the official include hostname consistently returns no valid SPF policy, contact the **provider’s support team**. Ask whether the hostname is still active, whether its DNS configuration has changed, and which SPF value you should use. Avoid replacing provider includes with guessed IP addresses. [Email service providers](https://www.activecampaign.com/glossary/email-service-provider) may use changing sending infrastructure, making incomplete IP lists unreliable. ## Understand SPF DNS Lookup and Void Lookup Limits RFC 7208 limits SPF evaluation to 10 DNS-querying terms. These include: - include - a - mx - ptr - exists - Redirect The ip4 and ip6 mechanisms do not count toward this [DNS-query](https://bunny.net/academy/dns/what-is-a-dns-and-recursive-query/) limit. SPF also has a separate concept called a void lookup. RFC 7208 recommends that implementations limit void lookups to two. Exceeding an implementation’s configured void lookup limit can produce permerror. These issues are related but different: - **Void lookup**: A DNS query returns **NXDOMAIN or NOERROR** without an answer. - **DNS lookup limit**: SPF evaluation exceeds the permitted number of DNS-querying terms. - **SPF PermError**: SPF evaluation cannot be completed because of a permanent configuration or evaluation error. Remove unnecessary includes and investigate DNS references that return empty responses to help prevent these problems. ![What Is Dmarc 1023](https://media.mailhop.org/dmarcreport/what-is-dmarc-1023-1793605778332.jpg) ## Does a Null DNS Lookup Affect DMARC Authentication? A problematic SPF include can cause SPF evaluation to return permerror. However, this does not automatically mean [DMARC](https://dmarcreport.com/) authentication will fail. DMARC passes when at least one of these conditions is met: 1. SPF passes and the authenticated SPF domain aligns with the visible From domain. 2. [DKIM](https://dmarcreport.com/what-is-dkim/) passes and the signing domain aligns with the visible From domain. Therefore, an aligned [DKIM signature](https://docs.mapp.com/docs/dkim-signature) may allow DMARC to pass even when SPF encounters an error. However, you should still **correct the SPF configuration**. _Review DMARC aggregate reports to understand how different sending services perform authentication_. ## Best Practices to Prevent SPF Include Errors Follow these practices to maintain a reliable SPF configuration: - **Verify provider hostnames**: Use current SPF values from official documentation. - **Review DNS records:** Check for missing, outdated, or incorrect include mechanisms. - **Remove unused services**: Eliminate obsolete SPF references after confirming they are unnecessary. - **Monitor lookup limits**: Keep SPF evaluation **within the 10-term limit**. - **Check void lookups**: Investigate include ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) AutoSPF Automatic SPF Flattening Streamline your SPF record management, enable DMARC compliance, and improve your email deliverability by fixing the SPF 10-lookup limitation. [ Fix My SPF Record! → ](https://autospf.com/pricing/?utm%5Fsource=dmarcreport&utm%5Fmedium=blog-sidebar&utm%5Fcampaign=autospf-cross-promo&utm%5Fcontent=fix-my-spf) [ See How It Works ](https://autospf.com/how-it-works/?utm%5Fsource=dmarcreport&utm%5Fmedium=blog-sidebar&utm%5Fcampaign=autospf-cross-promo&utm%5Fcontent=how-it-works) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Ffix-null-dns-lookup-errors-caused-by-spf-include-records%2F) [ ](https://twitter.com/intent/tweet?text=How%20To%20Fix%20%E2%80%9CA%20Null%20DNS%20Lookup%20Was%20Found%20For%20Include%E2%80%9D%20In%20SPF&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Ffix-null-dns-lookup-errors-caused-by-spf-include-records%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Ffix-null-dns-lookup-errors-caused-by-spf-include-records%2F) Copy Related Articles - [ ![10 Reasons Why DKIM Fails](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 10 Reasons Why DKIM Fails Intermediate ](/blog/10-reasons-why-dkim-fails/) - [ ![cybersecurity news](https://media.mailhop.org/dmarcreport/dmarc-check-9711-1784029121308.jpg) Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Intermediate ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/) - [ ![Cybersecurity Threats Weekly Roundup](https://media.mailhop.org/dmarcreport/dmarc-lookup-2281-1792584391252.jpg) Ahold Delhaize Cyberattack, French Supermarkets Hacked, Spyware Through Ads Intermediate ](/blog/ahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads/) - [ ![AppRiver SPF Record](https://media.mailhop.org/dmarcreport/dmarc-check-7224-1785846270575.jpg) AppRiver SPF Record: How To Set It Up (Owned By Zix) Intermediate ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/) ## Related Articles [ Intermediate 4m 10 Reasons Why DKIM Fails Apr 19, 2022 ](/blog/10-reasons-why-dkim-fails/)[ Intermediate Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Jul 14, 2026 ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/)[ Intermediate Ahold Delhaize Cyberattack, French Supermarkets Hacked, Spyware Through Ads Oct 21, 2026 ](/blog/ahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads/)[ Intermediate AppRiver SPF Record: How To Set It Up (Owned By Zix) Aug 4, 2026 ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"473","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"How To Fix “A Null DNS Lookup Was Found For Include” In SPF","description":"Fix the SPF null DNS lookup error by correcting invalid include records and updating DNS settings to improve email deliverability.","url":"https://dmarcreport.com/blog/fix-null-dns-lookup-errors-caused-by-spf-include-records/","datePublished":"2026-11-02T00:00:00.000Z","dateModified":"2026-11-02T00:00:00.000Z","dateCreated":"2026-11-02T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 5,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"473","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/fix-null-dns-lookup-errors-caused-by-spf-include-records/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/dmarc-check-4586-1793605285472.jpg","caption":"Null DNS Lookup"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"How To Fix “A Null DNS Lookup Was Found For Include” In SPF","item":"https://dmarcreport.com/blog/fix-null-dns-lookup-errors-caused-by-spf-include-records/"}]} ```