SPF: the 10-lookup limit that silently breaks e-mail

SPF is a TXT record at the apex of your domain, starting with v=spf1, that lists which servers are allowed to send e-mail on your behalf. Receivers look it up on every incoming message and use it to decide whether the sender is legitimate.

dig example.com TXT +short | grep spf1

The rules that actually bite

• Exactly ONE SPF record. Two SPF records is worse than none: receivers return permerror and ignore both.
• At most 10 DNS lookups (RFC 7208 §4.6.4). Every include:, a:, mx:, exists: and redirect= costs one — and includes bring their own includes. Cross the limit and your SPF stops working with NO visible error: mail keeps flowing, authentication silently stops.
• End with ~all or -all. A +all authorizes every server on the internet — the same as having no SPF, published in writing.

The lookup limit is the one to watch over time: each new SaaS tool asks you to "just add our include", and the eleventh one breaks the record for everyone. Count lookups before adding, not after deliverability drops.