Last night you added one more include: to the SPF string. This morning Gmail and corporate receivers bounce or softfail your mail. The TXT is still in the zone; dig still returns it. The failure is often not a “wrong IP” — you hit the SPF maximum of 10 DNS lookups.
RFC 7208 caps the DNS queries triggered by mechanisms such as include, a, mx, ptr, exists, and redirect at ten. Every marketing ESP, CRM, invoicing tool, and “send as” vendor brings its own include tree. Nested includes count too. Past ten, evaluation ends in permerror and receivers treat SPF as broken.
Why “one more tool” kills mail overnight
A clean EuroVDC corporate baseline is usually: MX priority 10 → securemail.eurovdc.eu, SPF v=spf1 mx ip4:45.84.90.12 -all. Here mx costs one lookup; ip4 does not. Adding include:_spf.example-esp.com looks like a single token, yet that ESP record may open three to six further includes. A second vendor the same evening becomes the lookup that tips you over the limit.
Record table and deliverability context: SPF, DKIM, DMARC and deliverability. With nameservers ns1.eurovdc.eu / ns2.eurovdc.eu, edit the zone in the EuroVDC panel; TXT steps: nameservers and DNS records.
How to count lookups
- Fetch the apex SPF TXT; merge duplicates first — two SPF TXT records are already invalid.
- Add one for each
include:,a,mx,ptr,exists, andredirect=; recurse into nested includes. - Open include targets with dig or an SPF checker; “lookups: 11+” means permerror risk.
- Delete unused includes — abandoned ESPs silently inflate the counter.
When you are over the limit
Stop forcing every campaign through the apex From domain. Put newsletters on a subdomain with its own SPF/DKIM; keep invoices on the apex with the EuroVDC baseline. Some ESPs offer SPF flattening (expanding to IP lists) — it lowers lookups short-term but goes stale when the vendor rotates IPs, so treat it as maintained debt.
For DMARC alignment, DKIM often survives forwarding better than SPF; publish both on the corporate mailbox. EU-hosted boxes: corporate email.
FAQ
Do ip4 and ip6 count toward the 10?
No. Direct IP mechanisms skip the DNS lookup quota. include/mx/a count.
Does -all versus ~all change the lookup count?
No. all is only the policy tail. The limit comes from mechanism DNS work.
Will two SPF TXT records fix the limit?
No — they break SPF. Receivers expect one record. Merge into a single string.
Can I drop mx and keep only ip4?
That saves a lookup, but you must update SPF if MX changes. The EuroVDC baseline pairs mx with ip4 on purpose.
permerror versus softfail?
permerror means SPF could not be evaluated (limit, syntax). softfail (~all) means “probably unauthorized.” DMARC and Gmail may treat both harshly.
