SPF lookup limit

An SPF record is allowed to cause at most ten DNS lookups during evaluation. The limit is in RFC 7208 and it is a hard failure, not a warning: a record that exceeds it evaluates to permerror, which most receivers treat as no SPF at all.

Why anyone hits it

Each include: counts. So does a, mx, ptr and redirect. And an include: is recursive — including a provider whose own record includes three others spends four of your ten.

A record like this is already at eight:

v=spf1 include:_spf.google.com include:sendgrid.net
       include:servers.mcsv.net include:spf.protection.outlook.com ~all

Adding one more provider takes it over, and nothing tells you. The record still looks correct. It simply stops authorising anything.

The part that makes it nasty

The count depends on records you do not control. A provider you include can expand their own record — quite legitimately — and push you over the limit without you changing anything. Your mail starts failing SPF on a day you did not deploy.

Fixing it

Flattening (resolving includes into literal IP ranges) works and creates a new problem: you now have to re-flatten whenever a provider changes IPs, and you will not be told. Removing providers you no longer use is the boring fix and usually the right one.

Related

IT Watch counts the lookups in every monitored domain's SPF record on every check and warns before the limit rather than after.

See also: DMARC alignment.