SPF record exceeds the 10 DNS lookup limit

What causes this

Each include:, a, mx, ptr, exists: and redirect= mechanism costs one DNS lookup, and every include pulls in that provider's own record, whose mechanisms count too. RFC 7208 caps the total at 10 to stop SPF being used to amplify DNS traffic. Once a record goes over the cap, receivers return permerror rather than evaluating the mechanisms they did manage to resolve — so the senders listed at the end of your record are not the only ones affected; the whole record fails.

What it breaks

SPF returns permerror for all of your mail, not just for the senders past the tenth lookup. Mail that would otherwise have passed SPF now fails it, and DMARC loses its SPF path.

How to fix it

Reduce the number of lookup-costing mechanisms until the total is 10 or fewer.

1. 1Remove includes for services you no longer use — this is usually where most of the budget has gone.
2. 2Replace an include with the specific ip4:/ip6: ranges it resolves to where the provider publishes stable addresses. IP mechanisms cost zero lookups.
3. 3Consolidate onto fewer sending services where the same job is being done twice.
4. 4Avoid ptr, which costs a lookup and is deprecated.
5. 5Re-check after each change — the count is what the receiver computes, not what the record looks like.