SPF: more than 10 DNS lookups (permerror) — how to fix

What's wrong

RFC 7208 limits SPF to 10 mechanisms that need a DNS lookup: include, a, mx, ptr, exists, redirect. Nested includes count too. On the 11th the receiver returns permerror and SPF for the domain is treated as broken — mail goes to spam or fails DMARC.

ip4, ip6 and all need no lookup and don't count.

How to check

Open Email DNS Checker — the "SPF dependency tree" shows how many lookups each include pulls in.

How to fix

1. Remove what you don't use. Services you no longer send through (an old ESP, CRM, test SMTP) go first.
2. Don't use ptr — it's deprecated and expensive. Replace a and mx with explicit ip4:/ip6: when the addresses are stable.
3. Split mail streams by subdomain. Marketing on news.example.com with its own SPF, transactional mail on mail.example.com. Each has its own limit of 10.
4. Flattening — carefully. Replacing include with an IP list works until the provider changes addresses. Only do it with automatic updates.

; before: 12 lookups
example.com. TXT "v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org include:spf.crm.example a mx ~all"
; after: transactional mail on a subdomain, unused senders removed
example.com.      TXT "v=spf1 include:_spf.google.com ip4:203.0.113.10 ~all"
mail.example.com. TXT "v=spf1 include:sendgrid.net ~all"

Re-check the domain afterwards: the tree should show ≤ 10 lookups.