Where you saw it: An SPF validator reporting a lookup count above ten, or a DMARC report showing permerror after you added a new sending platform.
Why it happens
- Every include, a, mx, exists and redirect mechanism costs one lookup, and the includes inside those records count too. The budget is consumed recursively.
- Adding a platform is what usually breaks it. A domain sitting at nine lookups works perfectly until someone connects a helpdesk.
- One vendor include can cost three or four lookups on its own, because their record includes others. You spend the budget without seeing where it went.
- The ip4 and ip6 mechanisms cost nothing, so a record full of raw addresses never hits this limit and a record full of vendor names does.
The fix, in order
Get the real count and the breakdown
Use a validator that shows which mechanism cost what. You are looking for the one include that is quietly spending four lookups.
Remove senders you no longer use
Most records over the limit carry a platform someone stopped using two years ago. This step alone fixes a good share of cases and costs nothing.
Replace a large include with its IP ranges
If a vendor publishes a stable set of sending addresses, put ip4 ranges in your record instead of their include. The mechanisms cost zero lookups.
Move a sender onto a subdomain
Send marketing mail from news.example.com with its own SPF record. The subdomain gets a fresh ten-lookup budget and your root record loses that include entirely.
Think hard before flattening
Flattening replaces every include with the addresses it currently resolves to. It works and it goes stale silently when a vendor changes their infrastructure, which is a delivery outage nobody gets an alert about.
v=spf1 ip4:198.51.100.0/24 include:_spf.google.com -allThe ip4 range costs nothing. The include costs at least one.
How to know it worked
The short version
- The validator reports ten or fewer lookups.
- Authentication-Results on a test message reads spf=pass.
- Every sending platform still passes. Check each one, because a subdomain move or a flattening pass can drop a sender you forgot to test.
Questions people ask
Why is the limit ten?
It exists to stop SPF evaluation being used as a denial-of-service amplifier. A receiver will not chase an unbounded chain of DNS queries for one message, so the specification caps it.
Do ip4 mechanisms count toward the limit?
No. Only mechanisms that require a DNS query count: include, a, mx, ptr, exists and redirect. Raw IP ranges are free, which is why they are the usual escape route.
Is SPF flattening safe?
It works until a vendor changes IPs. If you flatten, automate the refresh and alert on the diff, because the failure mode is silent and arrives weeks after the change.