Why this one matters more than it looks
An SPF record that exceeds ten DNS lookups returns a permanent error. Receiving servers treat that as no SPF at all, so your mail starts being filtered and nothing anywhere tells you. The record still reads as correct when you look at it.
It happens gradually. Each include costs a lookup, and whatever that include itself contains costs more. Adding one marketing tool to a record that was on nine takes you over, and nothing about that change looks dangerous.
What to do if you are over
- Remove senders you no longer use. Most records over the limit contain at least one.
- Replace an
includewith the specificip4ranges where the sender publishes them, since an IP costs nothing. - Move a sender to a subdomain with its own SPF record, which gets its own budget of ten.
The full guide has the order to do these in.
See also