Glossary · Authentication
SPF allows at most 10 DNS lookups per evaluation; a record that needs more returns a permanent error, which receivers treat as an SPF failure.
RFC 7208 caps the work a receiver does for one SPF check. The mechanisms include, a, mx, ptr and exists, and the redirect modifier, each cost a lookup, and lookups inside included records count too. ip4, ip6 and all are free.
A second limit applies to “void” lookups, ones that return nothing: more than two is also a permanent error. Records usually creep over the limit one new tool at a time, which is why it's worth checking after every change. The fixes are removing stale includes, moving senders to subdomains, or flattening.
Every domain you run in one inbox, from $3 a mailbox. 14 days free, no card.