An SPF check may use at most 10 terms that trigger DNS queries: include, a, mx, ptr, exists and redirect. Exceed 10 and the receiver must return permerror, which means the record could not be interpreted. Every SaaS sender you add through an include spends part of that budget.
What counts toward the limit
RFC 7208 lists the terms that cause DNS queries: the include, a, mx, ptr and exists mechanisms, and the redirect modifier. Together they may not exceed 10 during one evaluation.
Terms that do not query DNS are free: all, ip4, ip6 and the exp modifier. That is the main lever you have. A literal IP range costs nothing, an include costs at least one lookup.
The count is recursive. Your record might contain only four includes, but if each of those vendor records contains two more includes, you are already at 12. You do not control the vendor's record, and vendors change them.
Extra limits inside the limit
The mx mechanism has a second cap: evaluating each MX record must not trigger more than 10 address lookups, and going over makes the mechanism return permerror. The ptr mechanism is capped the same way, but extra records are ignored there. The standard also tells publishers not to use ptr at all.
There is also a "void lookup" rule. Receivers SHOULD stop after two lookups that return nothing (an empty answer or a name error). A stale include pointing at a vendor domain that no longer publishes SPF can burn those two quickly.
What permerror does to your mail
The RFC describes permerror as an error that "definitely requires DNS operator intervention". The SPF result is neither pass nor fail. With DMARC, a failed SPF means you depend on DKIM alone for that message. If a sender has no aligned DKIM signature, the message fails DMARC.
The trap is that nothing looks broken on your side. The record parses fine in a text editor. Only a full evaluation by a checker that counts nested lookups shows the problem.
How to get back under 10
- List every include and trace it down to its leaf lookups. Count them.
- Remove senders you no longer use. Old marketing tools are common offenders.
- Replace
aandmxwithip4orip6where the addresses are stable. RFC 7208 itself notes that literal IP mechanisms are less resource intensive. - Move a high-volume sender to its own subdomain with its own SPF record. Each domain gets its own budget of 10.
- Rely on DKIM for third-party senders and keep their IPs out of your root record when you can.
Avoid tools that "flatten" a record into IPs without a plan for refreshing it. Vendors change their addresses, and a flattened record goes stale silently.
Quick check
Do ip4 and ip6 mechanisms count toward the 10 lookups?
No. RFC 7208 says all, ip4, ip6 and exp do not cause DNS queries at evaluation time, so they are not counted.
Does a record with 11 includes always fail?
If evaluation reaches the eleventh term, the receiver must return permerror. A match earlier in the record can stop evaluation before the limit is hit, but you should not design around that.
Sources
Last reviewed: 19 October 2026.
