The 10-DNS-lookup limit

RFC 7208 caps SPF evaluation at 10 DNS-querying mechanisms (include, a, mx, ptr, exists — plain ip4/ip6 don't count) to bound the work a lookup can force on a resolver. Each nested include: (common with third-party senders like include:_spf.google.com) counts toward the total, so stacking several email providers is the usual way domains exceed it.

Exceeding the limit is a hard permerror — the fix is consolidating includes (e.g. via a provider-specific "flatten" service) or dropping unused ones, not adding more.