The SPF ten lookup limit

SPF allows a maximum of ten mechanisms that cost a DNS lookup. Go over it and receivers return permerror, which means your SPF is treated as broken rather than as a fail. Nothing announces this. Mail keeps flowing until something downstream starts caring, and then it does not.

What counts

These cost a lookup each: include:, a, mx, ptr, exists: and redirect=. These are free: ip4:, ip6: and all.

Includes count recursively

The limit applies to the whole chain, not to your record. One include: that resolves to a provider record containing three more includes has already used four of your ten. This is why adding a fourth or fifth SaaS sender is often what tips a working record over the edge.

plaintext

# this is already 4 lookups, not 1
v=spf1 include:_spf.google.com -all

# because _spf.google.com contains
v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all

Getting back under it

Remove includes for services you no longer use, which is usually the quickest win and worth checking first. Replace an include with the ip4: ranges behind it if the provider publishes stable addresses, though you then own the job of keeping them current. Use a subdomain for bulk mail, so your newsletter provider gets its own SPF record and its own budget of ten.

Mail Check counts the whole chain for you, including the nested includes, so you can see how much headroom is actually left.