What Is SPF DNS lookup limit?

Count evaluated terms, not just includes

RFC 7208 places a maximum of ten on the SPF terms that cause DNS queries during evaluation. Relevant terms include mechanisms such as include, a, mx, ptr and exists, and the redirect modifier when evaluated. Nested evaluation matters. Counting only the include statements visible in the top-level TXT record can therefore miss work performed through another domain's policy.

The limit concerns DNS-causing terms in SPF evaluation, not a simple count of network packets. Some terms require more than one query, and the specification has additional limits for particular operations. Mechanisms such as ip4, ip6 and all do not create these DNS lookups. A provider's diagnostic label should be checked against the actual evaluation path and the resource limit it reports.

Why a policy can fail unexpectedly

A policy can change when an included provider changes its own record, even if your top-level text remains identical. Different sending identities or matching paths can also expose different evaluation behavior. An excess produces SPF permerror rather than a successful authorization result. That is distinct from a temporary DNS problem or an ordinary not-authorized result.

Investigate before editing authorization

Inventory the legitimate sending services and inspect their current published policies. Test representative authorized senders and relevant paths, then record which evaluated terms consume the limit. Removing an active provider merely to lower a checker count can break legitimate mail. Converting includes into fixed IP addresses can create maintenance problems when a provider changes infrastructure. Choose a provider-supported correction and verify the resulting authentication at a receiver. A policy under the lookup limit can still authorize the wrong systems, fail alignment or encounter delivery problems; the limit is one validity check, not a complete deliverability test.