SPF stays within the 10-lookup limit

SPF evaluation is capped at ten DNS-querying terms. The mechanisms that count are include, a, mx, ptr and exists, plus the redirect modifier — ip4, ip6 and all are free because they resolve nothing. The limit is not on the number of terms in your record; it is on the total across everything your record pulls in, so a single include of a provider who themselves include three others can spend four of your ten.

Crossing the limit does not degrade gracefully. The receiver stops evaluating and returns permerror, which is not a fail and not a pass — and because most receivers treat permerror as "no usable SPF result", mail that would have passed is suddenly unauthenticated. Under a DMARC policy of quarantine or reject, and with no DKIM signature to fall back on, that is the difference between delivery and the junk folder.

It also fails silently and late. The record parses, every tool that only counts your own terms says it is fine, and the breakage appears the day a provider adds one more include to a record you do not control.

Start by removing what you are no longer using. Most records over the limit got there by accumulation — a former marketing platform, a ticketing system nobody has logged into for two years. Each include you delete is at least one lookup back.

Where a sender publishes fixed addresses, replace their include with the ip4 and ip6 ranges directly. Those cost nothing against the limit. The trade is that you now own keeping them current, so this is right for a provider with a stable, documented range and wrong for a large cloud platform that renumbers.

Consider whether every sender needs to be in the apex record at all. Mail from a separate subdomain — mail.example.com, notifications.example.com — carries its own SPF record and its own budget of ten, and under relaxed DMARC alignment it still aligns with the organisational domain.

Treat automated "SPF flattening" carefully. Expanding every include into literal addresses does fit inside the limit, but it converts a record your providers maintain into one you must re-flatten whenever any of them renumbers. If you use it, use a service that re-checks continuously rather than a one-off expansion pasted into DNS.