What counts toward the 10
Every mechanism that makes the receiver look something up in DNS counts: include, a, mx, ptr, exists and redirect. Includes inside includes count too, which is how a record with four includes can still blow past ten.
These do not count: ip4, ip6 and all. There is a second limit as well: no more than two lookups may come back empty.
An example that fails
"v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:servers.mcsv.net include:sendgrid.net include:mailgun.org a mx -all"Seven mechanisms on the surface, but several of those includes contain more includes. Together they easily pass ten.
How to get under the limit
- Remove services you no longer use. Old includes for a tool you cancelled years ago are the most common cause.
- Replace a and mx with ip4 and ip6 entries for your own servers, if their addresses rarely change.
- Never use ptr. It is slow, deprecated, and costs lookups.
- Move bulk senders such as newsletters to a subdomain (news.example.com) with its own SPF record.
- Be careful with 'flattening' (replacing includes with the IP addresses behind them). It works, until your provider changes its addresses and your mail starts failing without warning.
Two rules that cause similar errors
- Only one SPF record per domain. Merge them into one.
- End with -all (reject everything else) or ~all (mark it). A record without an all at the end does not protect anything.
Check yours in twenty seconds.
Free, no account, nothing stored. It says in plain words what to fix.
Check your domain's mail setup