The SPF specification (RFC 7208) caps the number of DNS-querying mechanisms a receiver must resolve when checking a record at 10. The mechanisms that count are include, a, mx, ptr and the redirect modifier; ip4, ip6 and all cost nothing because they need no lookup.
The limit exists to stop a single SPF evaluation from triggering an unbounded chain of DNS queries. Crucially, nested includes count too: one provider's include may itself contain several more, so the count grows faster than it looks. When evaluation exceeds 10 lookups the receiver returns a permerror, and most treat that as no usable SPF result, undermining both SPF and DMARC alignment.
A related rule limits void lookups (those returning no records, such as NXDOMAIN) to two before a permerror is also raised. To stay compliant, audit your record, remove unused includes, replace deprecated ptr usage, and consider SPF flattening for providers you cannot drop.
Check your live count with an SPF analyser before you hit the ceiling. DMARC Engine monitors this continuously so a new vendor never quietly pushes your record over the limit.
Check it on your domain
- SPF Checker: validates SPF and counts DNS lookups against the limit of 10.
- SPF Generator: generates an SPF record from your list of senders.
- DNS Record Checker: looks up any DNS record type for a host.