The ten DNS lookup limit
RFC 7208 section 4.6.4 allows no more than ten DNS lookups while an SPF record is evaluated. The mechanisms include, a, mx, ptr and exists each cost one lookup, and so does the redirect modifier. Lookups made inside an include count towards the same total, which is why a record with four includes can be far over the limit while looking short.
The same section limits void lookups, the ones that return an empty answer or a name that does not exist, to two. Crossing either limit gives permerror, and a large share of receivers treat permerror the same way as a failed check. This tool follows the whole chain and shows the running count.
What to do when there are too many lookups
- Remove services you no longer use. An old include survives for years after the service behind it is gone.
- Replace some includes with the actual ip4 and ip6 ranges. Those cost no lookups, but you have to watch for changes on the provider side.
- Do not use ptr. It is slow, unreliable and discouraged for SPF.
- Keep one record per domain and end it with -all or ~all, not ?all.