The SPF 10-lookup limit, explained

To evaluate an SPF record, a receiver may perform at most 10 DNS lookups. The mechanisms include, a, mx, ptr and exists each count, and so does the redirect modifier. Lookups inside an included record count too. ip4, ip6 and all do not.

If evaluation needs more than 10, SPF returns a permanent error. For DMARC, SPF then fails, and if DKIM is not also passing and aligned, the message fails DMARC.

Each service you add tells you to include its SPF record, and many of those records include others. A mailbox provider, a CRM, a helpdesk and a marketing platform can use most of the budget between them.

Remove includes for services you no longer use. Check each remaining one: some services do not need SPF at all if they sign with DKIM, because DMARC only needs one of them to pass and align.

Where you must keep many includes, SPF flattening replaces them with the IP ranges they resolve to. The catch is that providers change those ranges, so a flattened record must be kept current. That is the part worth automating.

Receivers also count lookups that return no result, called void lookups, and stop at two. A stale include that points to a name that no longer exists can cause errors on its own.