SPF "too many DNS lookups": the 10-lookup limit

RFC 7208 section 4.6.4 says SPF implementations must limit DNS-querying terms to 10 per check and return permerror when a record needs more. Many receivers then treat SPF as failed, so mail from servers you did authorize can fail DMARC.

Count your lookups now (free), or call GET /v1/spf?domain= from code.

What counts

Counts (1 each, plus everything nested)	`include`, `a`, `mx`, `ptr`, `exists`, `redirect`
Free	`ip4`, `ip6`, `all`, `exp`
Void lookups	Terms whose lookup returns no record or NXDOMAIN. Limit: 2 (RFC 7208 4.6.4).

An include runs a full SPF check against the included domain, so its own includes count too. A record with three visible includes can cost ten or more lookups.

How to get back under 10

Remove includes for services you no longer send from.
Replace a and mx with ip4/ip6 when those hosts have stable addresses.
Move bulk or marketing mail to a subdomain (for example mail.example.com) with its own SPF record.
Prefer DKIM-aligned sending: DMARC passes when DKIM aligns, even if SPF does not.
Flattening (replacing includes with IP ranges) works only if something keeps the list current; providers change their ranges.

Watch it over time

Your count depends on records that third parties control. If a provider adds an include, you can go over the limit without touching your DNS. Re-check after adding any new sender.

Sources: RFC 7208 4.6.4, 5.2.